Subject: Extended certificate status fields (WAS: some thoughts re DPD and DPV)

From: [email-masked]
Date: Mon, 26 Mar 2001 10:15:06 +0100

Peter, All,

I agree that the current OCSP certificate status values have room for
improvement.  I like the idea of an extension to achieve this purpose, but
don't see why we should restrict ourselves simply to a boolean.  Why not a
new 'detailedStatus' enum, that covers some of the other different states
explicitly: not yet valid, expired, suspended, for example, as well as
those states already discussed.  Alternatively, since not all of these
states a mutually exclusive, some kind of bitfield may be preferred.

Regards,

Jonathan
------------
Dr Jonathan Tuliani
www.symbian.com

                    [email-masked]                                                                                   
                    land.ac.nz             To:     [email-masked], [email-masked]                             
                    (Peter Gutmann)        cc:     [email-masked]                                                       
                    Sent by:               Subject:     RE: some thoughts re DPD and DPV                              
                    [email-masked]                                                                                   
                    land.ac.nz                                                                                        

                    24/03/01 14:02                                                                                    
                    Please respond                                                                                    
                    to pgut001                                                                                        

Speaking of OCSP, I have a suggestion for v2: Currently the status values
which
are returned are not-revoked, revoked, and unknown (note that I've used
"not-
revoked" rather than "OK" because what's called "OK" doesn't actually mean
the
cert is OK).  I've had a request from a user in Germany for an addition to
this
which provides a true-OK response (that is, a response of "This certificate
was
definitely issued and is valid as of the time the response was sent") as
well
as a true-invalid response ("This certificate wasn't issued/has been
revoked/has expired").  My suggestion for providing this was to create a
(private) extension which contains this information, but given that things
like
ISIS are doing something similar by overloading RFC 2560 it might be useful
to
make this a bit more standardised by adding it to the RFC rather than
having
everyone invent their own incompatible, ad-hoc solutions.

Note that this isn't any infringement on DPD/DPV's territory, all this is
doing
is providing more useful status information than the current return values
do.
For the extension I'd proposed the following:

  ExtendedStatus ::= BOOLEAN

  If set to true, the responder is indicating that the certificate has been
  issued and is curently valid.

  If set to false, the responder is indicating that the certificate has not
  been issued, has not become valid yet or has expired, or has been revoked
  (more information is contained in the certStatus field) or otherwise
  withdrawn from use.

This doesn't do any path validation or anything else provided for in
DPD/DPV,
all it is is an assertion from the CA/responder that as far as they're
concerned it's valid or it's not valid.  This is a very simple fix to OCSP
which is fully backwards-compatible and helps avoid the problems caused by
the
limited ability of the certStatus value to report certain certificate
conditions.

Peter.

**********************************************************************
Symbian Ltd is a company registered in England and Wales with registered number 01796587 and registered office at 19 Harcourt Street, London, W1H 4HF, UK.
This message is intended only for use by the named addressee and may contain privileged and/or confidential information. If you are not the named addressee you should not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify [email-masked] and delete the message and any attachments accompanying it immediately. Symbian does not accept liability for any corruption, interception, amendment, tampering or viruses occuring to this message in transit or for any message sent by its employees which is not in compliance with Symbian corporate policy.
**********************************************************************