Subject: RE: RFC 2560 - OCSP - Clarification

From: Mathew Butler <[email-masked]>
Date: Mon, 28 Aug 2000 13:13:20 -0700

I think that there's a problem with this idea.  If the responder doesn't
know about the CA, or have the ability to verify the CA's signature on the
certificate versus the CRL, the response should be "unknown" rather than
"good".

"Good" should indicate: "The certificate was apparently issued by a CA that
the responder has current revocation information for, and the certificate
has not been revoked."

Forgive me for not reading the draft as thoroughly as I should have; is
there any call for the responder to cryptographically check the certificate
at any point during the request?

-Mat Butler

-----Original Message-----
From: Rich Salz [mailto:[email-masked]]
Sent: Monday, August 28, 2000 8:08 AM
To: Sam Schaen
Cc: [email-masked]'
Subject: Re: RFC 2560 - OCSP - Clarification

The text in uppercase is contradicted by the sentence that immediately
follows.  If good doesn't mean the certificate was issued, then there
need not be a CA that issued it. :)

> 'The "good" state indicates that THE RESPONDER HAS CURRENT REVOCATION
> INFORMATION FROM THE CA THAT ISSUED THE CERTIFICATE AND the certificate
has not
> been revoked. It
> does not indicate whether the certificate was ever issued, is still valid
or
> any other assertion.

---

From: "Liaquat Khan" <[email-masked]>
Date: Wed, 30 Aug 2000 17:01:58 +0100

The problem is linked to the fact that OCSP generally uses CRLs as the base
information (although of course this doesn't have to be the case). And CRLs
basically contain identifiers for those certificates that have been revoked
(or suspended).  Therefore, if a particular certificates serial number is
not on a CRL, it maybe because it is still valid or maybe because it was
never issued in the first place.

Note that the OCSP standard makes a reference that extensions should be used
for providing additional information.

Regards,
Liaquat Khan
Technical Manager
Global Trust Authority

----- Original Message -----
From: Mathew Butler <[email-masked]>
To: 'Rich Salz' <[email-masked]>; Sam Schaen <[email-masked]>;
<[email-masked]>
Sent: Monday, August 28, 2000 9:13 PM
Subject: RE: RFC 2560 - OCSP - Clarification