Re: [lamps] [EXTERNAL] Re: draft-housley-lamps-norevavail-00

[Mike Ounsworth <[e-mail]>]

Interesting


RFC6960, section “4.2.2.2.1<https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2.1>.  Revocation Checking of an Authorized Responder”


“A CA may specify that an OCSP client can trust a responder for the
     lifetime of the responder's certificate.  The CA does so by
     including the extension id-pkix-ocsp-nocheck”

Are you allowed to put an id-pkix-ocsp-nocheck extension in end entity certs? If so, what does that mean?

I did a quick skim of the rest of the document and did not see this addressed (ie it’s undefined). The correct answer is probably that that is an invalid cert; that an extension id-pkix-ocsp-nocheck MUST NOT appear in a certificate unless it has an EKU id-kp-OCSPSigning.

Am I missing something? Is this addressed somewhere? If not then should that be an erratum for 6960?

---
Mike Ounsworth

From: Spasm <[e-mail]> On Behalf Of Russ Housley
Sent: Friday, May 19, 2023 2:56 PM
To: Seo Suchan <[e-mail]>
Cc: LAMPS <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] draft-housley-lamps-norevavail-00

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Seo:

id-pkix-ocsp-nocheck is to avoid asking an OCSP Responder for status for its own certificate.

Russ



On May 19, 2023, at 3:47 PM, Seo Suchan <[e-mail]<mailto:[e-mail]>> wrote:

I thought id-pkix-ocsp-nocheck already remove revocation check, but realized that's only for ocsp check - clients seeing certs with id-pkix-ocsp-nocheck extension expected to check CRL for that certificate? only thing it currently used is for designated OCSP responder(for root iirc?). and don't think it runs CRL for it.

2023-05-19 오전 6:23에 Russ Housley 이(가) 쓴 글:
I want the LAMPS WG to be aware of this I-D.  However, I do not think we should adopt it until the event predicted in the History section actually comes to pass:

   With greater use of short-lived certificates in the Internet, the
   next revision of ITU-T Recommendation X.509 [X.509-TBD] is expected
   to allow the noRevAvail certificate extension to be used with public
   key certificates as well as attribute certificates.

Russ



From: [e-mail]<mailto:[e-mail]>
Subject: New Version Notification for draft-housley-lamps-norevavail-00.txt
Date: May 18, 2023 at 4:51:35 PM EDT
To: "Joseph Mandel" <[e-mail]<mailto:[e-mail]>>, "Russ Housley" <[e-mail]<mailto:[e-mail]>>, "Tomofumi Okubo" <[e-mail]<mailto:[e-mail]>>


A new version of I-D, draft-housley-lamps-norevavail-00.txt
has been successfully submitted by Russ Housley and posted to the
IETF repository.

Name:                 draft-housley-lamps-norevavail
Revision:            00
Title:                    No Revocation Available for Short-lived X.509 Certificates
Document date:              2023-05-18
Group:                Individual Submission
Pages:                 8
URL:            https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt__;!!FJ-Y8qCqXTj2!Yqu9wyE0-zIwpBqoYCo8Z4pKh987HbA5NEk_0q7E6RXmBM9n_Nt2cL9g7IWpb6o3JA4Pih-A1yZCPQOWRZGdmYcXd3xw$>
Status:         https://datatracker.ietf.org/doc/draft-housley-lamps-norevavail/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-housley-lamps-norevavail/__;!!FJ-Y8qCqXTj2!Yqu9wyE0-zIwpBqoYCo8Z4pKh987HbA5NEk_0q7E6RXmBM9n_Nt2cL9g7IWpb6o3JA4Pih-A1yZCPQOWRZGdmRgHMOPz$>
Html:           https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html__;!!FJ-Y8qCqXTj2!Yqu9wyE0-zIwpBqoYCo8Z4pKh987HbA5NEk_0q7E6RXmBM9n_Nt2cL9g7IWpb6o3JA4Pih-A1yZCPQOWRZGdmXSmohtq$>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail__;!!FJ-Y8qCqXTj2!Yqu9wyE0-zIwpBqoYCo8Z4pKh987HbA5NEk_0q7E6RXmBM9n_Nt2cL9g7IWpb6o3JA4Pih-A1yZCPQOWRZGdmRzVEkGB$>


Abstract:
  Short-lived X.509v3 public key certificates as profiled in RFC 5280
  are seeing greater use in the Internet.  The Certification Authority
  (CA) that issues these short-lived certificates do not publish
  revocation information because the certificate lifespan that is
  shorter than the time needed to detect, report, and distribute
  revocation information.  This specification defines the noRevAvail
  certificate extension so that a relying party can readily determine
  that the CA does not publish revocation information for the
  certificate.



_______________________________________________

Spasm mailing list

[e-mail]<mailto:[e-mail]>

https://www.ietf.org/mailman/listinfo/spasm<https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!Yqu9wyE0-zIwpBqoYCo8Z4pKh987HbA5NEk_0q7E6RXmBM9n_Nt2cL9g7IWpb6o3JA4Pih-A1yZCPQOWRZGdmVFN8X86$>

Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.