Re: [lamps] [EXTERNAL] Re: draft-housley-lamps-norevavail-00

[Mike Ounsworth <[e-mail]>]

Thanks Russ.

That explanation passes the sanity check 😊

---
Mike Ounsworth

From: Russ Housley <[e-mail]>
Sent: Friday, May 19, 2023 11:07 AM
To: Mike Ounsworth <[e-mail]>; Tim Hollebeek <[e-mail]>
Cc: LAMPS <[e-mail]>; Joe Mandel <[e-mail]>; Tomofumi Okubo <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] draft-housley-lamps-norevavail-00

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Tim and Mike:

Some applications look for revocation information using mechanisms other than pointers in certificate extensions.  While there are not too many applications that use an X.500 Directory or LDAP, these applications look in the for revocation information in the CA's entry.  Similar queries are used with or HTTP certificate repositories defined in RFC 4387.  A flag to not bother looking is desirable for these applications.

Other applications, especially browsers, use non-standard revocation checking mechanisms for the CAs that are part of their trust anchor store.  When user organizations add their own trust anchors, they are not part of these non-standard revocation checking mechanisms.  Again, a flag to not bother looking is desirable.

The LAMPS Charter includes:

   1. Specify the use of short-lived X.509 certificates for which no
   revocation information is made available by the Certification Authority.
   Short-lived certificates have a lifespan that is shorter than the time
   needed to detect, report, and distribute revocation information.  As a
   result, revoking short-lived certificates is unnecessary and pointless.

It seems to me that a document stating that the lack of certain certificate extensions offers an opportunity for uncertainly.

Russ



On May 19, 2023, at 11:30 AM, Mike Ounsworth <Mike.Ounsworth=[e-mail]<mailto:Mike.Ounsworth=[e-mail]>> wrote:

+1 to Tim’s question.


> Short-lived X.509v3 public key certificates as profiled in RFC 5280
   are seeing greater use in the Internet.

What, specifically, are the use-cases driving this? If it’s browsers then I’d like to hear from a browser vendor about how they want to handle lack of revocation info (I suspect they just ignore it).

So yeah, exactly what Tim said: in what case is it helpful to explicitly state “No revocation info available” vs just leaving those extns out?

---
Mike Ounsworth

From: Spasm <[e-mail]<mailto:[e-mail]>> On Behalf Of Tim Hollebeek
Sent: Friday, May 19, 2023 8:59 AM
To: Russ Housley <[e-mail]<mailto:[e-mail]>>; LAMPS <[e-mail]<mailto:[e-mail]>>
Cc: Joe Mandel <[e-mail]<mailto:[e-mail]>>; Tomofumi Okubo <[e-mail]<mailto:[e-mail]>>
Subject: [EXTERNAL] Re: [lamps] draft-housley-lamps-norevavail-00

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Russ,

Can you briefly describe the advantages of explicitly stating this in a short-lived certificate, instead of simply omitting all relevant revocation fields?

-Tim

From: Spasm <[e-mail]<mailto:[e-mail]>> On Behalf Of Russ Housley
Sent: Thursday, May 18, 2023 5:24 PM
To: LAMPS <[e-mail]<mailto:[e-mail]>>
Cc: Joe Mandel <[e-mail]<mailto:[e-mail]>>; Tomofumi Okubo <[e-mail]<mailto:[e-mail]>>
Subject: [lamps] draft-housley-lamps-norevavail-00

I want the LAMPS WG to be aware of this I-D.  However, I do not think we should adopt it until the event predicted in the History section actually comes to pass:

   With greater use of short-lived certificates in the Internet, the
   next revision of ITU-T Recommendation X.509 [X.509-TBD] is expected
   to allow the noRevAvail certificate extension to be used with public
   key certificates as well as attribute certificates.

Russ


From: [e-mail]<mailto:[e-mail]>
Subject: New Version Notification for draft-housley-lamps-norevavail-00.txt
Date: May 18, 2023 at 4:51:35 PM EDT
To: "Joseph Mandel" <[e-mail]<mailto:[e-mail]>>, "Russ Housley" <[e-mail]<mailto:[e-mail]>>, "Tomofumi Okubo" <[e-mail]<mailto:[e-mail]>>


A new version of I-D, draft-housley-lamps-norevavail-00.txt
has been successfully submitted by Russ Housley and posted to the
IETF repository.

Name:               draft-housley-lamps-norevavail
Revision:          00
Title:                  No Revocation Available for Short-lived X.509 Certificates
Document date:            2023-05-18
Group:                            Individual Submission
Pages:               8
URL:            https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNwr7O5FiA$>
Status:         https://datatracker.ietf.org/doc/draft-housley-lamps-norevavail/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-housley-lamps-norevavail/__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNw-m8lCCA$>
Html:           https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNyD5wXkvA$>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNx-cXhRbw$>


Abstract:
  Short-lived X.509v3 public key certificates as profiled in RFC 5280
  are seeing greater use in the Internet.  The Certification Authority
  (CA) that issues these short-lived certificates do not publish
  revocation information because the certificate lifespan that is
  shorter than the time needed to detect, report, and distribute
  revocation information.  This specification defines the noRevAvail
  certificate extension so that a relying party can readily determine
  that the CA does not publish revocation information for the
  certificate.
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system. _______________________________________________
Spasm mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spasm<https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!b90XB8YZSLOoIZNy0j8NcQnhetFFJhOxh2mvwKxxG-XqV1uANDSQ7MeMXJUCt-eQZ1BtPT8wZKwoVGQInZK2yA$>