Re: [lamps] draft-housley-lamps-norevavail-00

Tim and Mike:

Some applications look for revocation information using mechanisms other than pointers in certificate extensions.  While there are not too many applications that use an X.500 Directory or LDAP, these applications look in the for revocation information in the CA's entry.  Similar queries are used with or HTTP certificate repositories defined in RFC 4387.  A flag to not bother looking is desirable for these applications.

Other applications, especially browsers, use non-standard revocation checking mechanisms for the CAs that are part of their trust anchor store.  When user organizations add their own trust anchors, they are not part of these non-standard revocation checking mechanisms.  Again, a flag to not bother looking is desirable.

The LAMPS Charter includes:

   1. Specify the use of short-lived X.509 certificates for which no
   revocation information is made available by the Certification Authority.
   Short-lived certificates have a lifespan that is shorter than the time
   needed to detect, report, and distribute revocation information.  As a
   result, revoking short-lived certificates is unnecessary and pointless.

It seems to me that a document stating that the lack of certain certificate extensions offers an opportunity for uncertainly.

Russ

> On May 19, 2023, at 11:30 AM, Mike Ounsworth <Mike.Ounsworth=40entrust.com@dmarc.ietf.org> wrote:
> 
> +1 to Tim’s question.
>  
> > Short-lived X.509v3 public key certificates as profiled in RFC 5280
>    are seeing greater use in the Internet.
>  
> What, specifically, are the use-cases driving this? If it’s browsers then I’d like to hear from a browser vendor about how they want to handle lack of revocation info (I suspect they just ignore it).
>  
> So yeah, exactly what Tim said: in what case is it helpful to explicitly state “No revocation info available” vs just leaving those extns out?
>  
> ---
> Mike Ounsworth
>  
> From: Spasm <spasm-bounces@ietf.org <mailto:spasm-bounces@ietf.org>> On Behalf Of Tim Hollebeek
> Sent: Friday, May 19, 2023 8:59 AM
> To: Russ Housley <housley@vigilsec.com <mailto:housley@vigilsec.com>>; LAMPS <spasm@ietf.org <mailto:spasm@ietf.org>>
> Cc: Joe Mandel <Joe.Mandel@secureg.io <mailto:Joe.Mandel@secureg.io>>; Tomofumi Okubo <tomofumi.okubo@gmail.com <mailto:tomofumi.okubo@gmail.com>>
> Subject: [EXTERNAL] Re: [lamps] draft-housley-lamps-norevavail-00
>  
> WARNING: This email originated outside of Entrust.
> DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
> Russ, 
>  
> Can you briefly describe the advantages of explicitly stating this in a short-lived certificate, instead of simply omitting all relevant revocation fields?
>  
> -Tim
>  
> From: Spasm <spasm-bounces@ietf.org <mailto:spasm-bounces@ietf.org>> On Behalf Of Russ Housley
> Sent: Thursday, May 18, 2023 5:24 PM
> To: LAMPS <spasm@ietf.org <mailto:spasm@ietf.org>>
> Cc: Joe Mandel <Joe.Mandel@secureg.io <mailto:Joe.Mandel@secureg.io>>; Tomofumi Okubo <tomofumi.okubo@gmail.com <mailto:tomofumi.okubo@gmail.com>>
> Subject: [lamps] draft-housley-lamps-norevavail-00
>  
> I want the LAMPS WG to be aware of this I-D.  However, I do not think we should adopt it until the event predicted in the History section actually comes to pass:
>  
>    With greater use of short-lived certificates in the Internet, the
>    next revision of ITU-T Recommendation X.509 [X.509-TBD] is expected
>    to allow the noRevAvail certificate extension to be used with public
>    key certificates as well as attribute certificates.
>  
> Russ
>  
>  
> 
> From: internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>
> Subject: New Version Notification for draft-housley-lamps-norevavail-00.txt
> Date: May 18, 2023 at 4:51:35 PM EDT
> To: "Joseph Mandel" <joe.mandel@secureg.io <mailto:joe.mandel@secureg.io>>, "Russ Housley" <housley@vigilsec.com <mailto:housley@vigilsec.com>>, "Tomofumi Okubo" <tomofumi.okubo+ietf@gmail.com <mailto:tomofumi.okubo+ietf@gmail.com>>
>  
> 
> A new version of I-D, draft-housley-lamps-norevavail-00.txt
> has been successfully submitted by Russ Housley and posted to the
> IETF repository.
> 
> Name:               draft-housley-lamps-norevavail
> Revision:          00
> Title:                  No Revocation Available for Short-lived X.509 Certificates
> Document date:            2023-05-18
> Group:                            Individual Submission
> Pages:               8
> URL:            https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt <https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNwr7O5FiA$>
> Status:         https://datatracker.ietf.org/doc/draft-housley-lamps-norevavail/ <https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-housley-lamps-norevavail/__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNw-m8lCCA$>
> Html:           https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html <https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNyD5wXkvA$>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail <https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail__;!!FJ-Y8qCqXTj2!aGMAtEGaEzGgAUElR2nDasYxEQAhagSpUVcwvvjJ8qnwC15CYPwQHfT9-eSKkHmj5jgvQ9FdRxmcWssDffszb-HLx4OSEx4UdNx-cXhRbw$>
> 
> 
> Abstract:
>   Short-lived X.509v3 public key certificates as profiled in RFC 5280
>   are seeing greater use in the Internet.  The Certification Authority
>   (CA) that issues these short-lived certificates do not publish
>   revocation information because the certificate lifespan that is
>   shorter than the time needed to detect, report, and distribute
>   revocation information.  This specification defines the noRevAvail
>   certificate extension so that a relying party can readily determine
>   that the CA does not publish revocation information for the
>   certificate.
> Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system. _______________________________________________
> Spasm mailing list
> Spasm@ietf.org <mailto:Spasm@ietf.org>
> https://www.ietf.org/mailman/listinfo/spasm <https://www.ietf.org/mailman/listinfo/spasm>