Subject: Re: OCSP request

From: Denis Pinkas <[email-masked]>
Date: Wed, 09 Aug 2000 11:38:22 +0200

Simon,
 
> All,
> 
> we have gone quite far from my original question, whether it is possible to
> clarify RFC2560 in such a way that ISIS semantics (and others) can be
> expressed in a clean way, adding to, not altering, the base semantics. 

I do no think that any "clarification" is needed for RFC 2560 to
this respect. The text is crystal clear and does not need to be
changed.

The text says for the "good status":

" The "good" state indicates a positive response to the status
inquiry. At a minimum, this positive response indicates that the
certificate is not revoked, but does not necessarily mean that the
certificate was ever issued or that the time at which the response
was produced is within the certificate's validity interval. Response
extensions may be used to convey additional information on
assertions made by the responder regarding the status of the
certificate such as positive statement about issuance, validity,
etc.

It is thus clear that extensions may carry any additional semantics
or fields. Such extensions may be defined using: 

requestExtensions    [2]   EXPLICIT Extensions OPTIONAL

in an OCSPRequest, or using:
 
responseExtensions   [1]   EXPLICIT Extensions OPTIONAL

in an OCSPResponse (more exactly in ResponseData).

If someone has some interest for some extension, it should be
defined in a *separate* document and then proposed to the PKIX
working group either to be on the standard track, being
informational or being experimental.

Denis

> The
> purpose being that OCSP clients should be able to be clients to both
> "ordinary" PKIs and ISIS model PKIs.
> 
> The discussion about whether there are other ways of meeting the design
> goals of the ISIS model is of course interesting, but I'm not sure how much
> that can be done about the model at this stage. Much of this model is set
> already in the underlying laws and regulations, and I suppose those are not
> going to change much in this respect.
> 
> Simon.
> 
> Simon Tardell, Software Architect, iD2 Technologies
> voice +46 8 7755225, fax +46 8 7267912, cell +46 70 3198319
> [email-masked], http://www.iD2tech.com
> Securing the Internet economy

---

From: "Shantanu Bhattacharya" <[email-masked]>
Date: Wed, 9 Aug 2000 14:51:46 +0530

I was wondering if there is any way one can keep track of the history of
secure operations done on a document in such a way as to be auditable at a
later point in time.

If anybody has any solution to this, please let me know.

Regards

Shantanu Bhattacharya
Project Manager
E-Lock Technologies Pvt. Ltd.

---

From: Simon Tardell <[email-masked]>
Date: Wed, 9 Aug 2000 10:18:43 +0200

> >P.S. What is the status of the ISIS solution? Is it already a
> >"rule/law"? Is it open to review/comments/suggestions?
> 
> ISIS is an interop specification by 9 German CAs (no, we 
> currently don't
> make laws;-).

All, 

expressed in a clean way, adding to, not altering, the base semantics. The

Simon.