[lamps] Re: I-D Action: draft-ietf-lamps-one-signature-certs-02.txt

[Stefan Santesson <[e-mail]>]

I just want to give some heads up regarding this update.

This update fixes all issues recorded on the Github page.

1) Updated requirement levels for noRevAvail and infinite validity
2) Defined OID for the extension
3) Added examples

In addition to this re text describing the rationale why revocation is 
obsolete for one signature certificates is updated with reference to 
standards clearly stating the revocation of a certificate after 
signature creation does not invalidate the signature. When the signing 
key is created and destroyed at the time of signing, no real reason for 
revoking that certificate remains.

The requirements were updated to recommend that noRevAvail and infinite 
validity is used. But this is no longer required. Having this 
recommended but not mandatory makes more sense as a certificate 
validator need to process these options separately anyway. If revocation 
is available, it must be processed. If validity is set, it must be 
honoured. If you issue certificates that will be processed by a 
validator that do not support noRevAvail, it could make sense to issue 
an empty CRL. It does not add value to this specification to prohibit 
such use.

I'll present the details in Austria.

/Stefan




On 2026-07-01 23:23, [e-mail] wrote:
> Internet-Draft draft-ietf-lamps-one-signature-certs-02.txt is now available.
> It is a work item of the Limited Additional Mechanisms for PKIX and SMIME
> (LAMPS) WG of the IETF.
>
>     Title:   One Signature Certificates
>     Authors: Stefan Santesson
>              Russ Housley
>     Name:    draft-ietf-lamps-one-signature-certs-02.txt
>     Pages:   17
>     Dates:   2026-07-01
>
> Abstract:
>
>     This document defines the signedDocumentBinding certificate
>     extension, which binds a certificate to the signed content of a
>     digital signature produced by a single signing operation.  Each
>     certificate is created at the time of signing and the associated
>     signing key is generated, used to produce a single digital signature,
>     and then immediately destroyed.  Certificates carrying this extension
>     are intended to be issued without a revocation mechanism and with no
>     expiration, which simplifies long-term validation.
>
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-lamps-one-signature-certs/
>
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-ietf-lamps-one-signature-certs-02.html
>
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-lamps-one-signature-certs-02
>
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> Spasm mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]