Subject: RFC 2560 - OCSP - Clarification

From: Ambarish Malpani <[email-masked]>
Date: Mon, 21 Aug 2000 08:08:37 -0700

Hi Folks,
    Simon (Tardell) and I were talking about the need for
clarification in section 2.2 of RFC 2560. We came up with
the following proposal and are looking for comments on the
changes

-----------------Begin Proposed Changes--------------------

Replace the three paragraphs (in section 2.2) that start:
'The "good" state...the certificate being requested.'
with:

'The "good" state indicates that the certificate has not been revoked. It
does not indicate whether the certificate was ever issued, is still valid or
any other assertion.

The "revoked" state indicates that the certificate has been revoked(either
permanantly or temporarily (on hold)).

The "unknown" state indicates that the responder does not know, or is
unwilling to tell, whether the certificate is revoked or not. A client may
be able to get a definitive response later, or at another responder.

Response extensions may be used to carry further status information (e.g. on
issuance).

-----------------End Proposed Changes--------------------

We are looking for comments on what the group thinks about these - they
are just clarifications that I think can go in when we roll over from
Proposed Standard to Draft Standard (at which time we should also add
the OID for the ASN.1 module).

Comments?
Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

---

From: Sam Schaen <[email-masked]>
Date: Mon, 21 Aug 2000 14:24:10 -0400

I would like to suggest the words included in all-caps below to highlight the
fact that the responder is in a position to know the revocation status of the
certificate.

'The "good" state indicates that THE RESPONDER HAS CURRENT REVOCATION
INFORMATION FROM THE CA THAT ISSUED THE CERTIFICATE AND the certificate has not
been revoked. It
does not indicate whether the certificate was ever issued, is still valid or
any other assertion.

---

From: Rich Salz <[email-masked]>
Date: Mon, 28 Aug 2000 11:08:25 -0400

The text in uppercase is contradicted by the sentence that immediately
follows.  If good doesn't mean the certificate was issued, then there
need not be a CA that issued it. :)

---

From: [email-masked] (Terry Hayes)
Date: Mon, 28 Aug 2000 10:01:35 -0700

Well, I guess the first sentence should read: "... current revocation information
from the CA that APPARENTLY issued the certificate".  I believe this is what is
intended.

Terry Hayes
[email-masked]

---

From: Rich Salz <[email-masked]>
Date: Mon, 28 Aug 2000 15:06:46 -0400

> permanantly or temporarily (on hold)).

I prefer something like
	The "revoked" state indicates that the certificate is revoked at the
time the responder recevied the query. The revocation may be permanent,
or temporary (i.e., on hold), and this state does not imply either
condition.

> be able to get a definitive response later, or at another responder.
I'd like to add
A responder SHOULD use an error response when possible to indicate
unwillingness, rather than lack of information.