Subject: [pkix] SCVP : nextUpdate in CertReply

From: Piyush Jain <[email-masked]>
Date: Thu, 26 Apr 2012 16:39:20 +0000

Hi All,

nextUpdate for CertReply is marked as optional in RFC 5055. However the text describing this field is silent about its meaning when this field  is not set.
It'll be useful to clarify it by adding something like

   "If the nextUpdate item is omitted, it indicates that newer information about the referenced certificate is always available and the client should not cache the information returned in this CertReply object."

Thoughts?

-Piyush

---

From: Russ Housley <[email-masked]>
Date: Thu, 26 Apr 2012 15:50:24 -0400

You do not know how long to cache it.  Asking one second later is not likely to get a different response.  In the past, there was not consensus for advice like you suggest.

Russ

On Apr 26, 2012, at 12:39 PM, Piyush Jain wrote:

> It’ll be useful to clarify it by adding something like
>  
>    “If the nextUpdate item is omitted, it indicates that newer information about the referenced certificate is always available and the client should not cache the information returned in this CertReply object.”
>  
> Thoughts?
>  
> -Piyush

---

From: Piyush Jain <[email-masked]>
Date: Thu, 26 Apr 2012 20:21:08 +0000

Fair enough.
But the text should either  provide some guidance on what NULL nextUpdate means or make it mandatory.

Here is the current text.

   The nextUpdate item tells the time at which the server expects a
   refresh of information regarding the validity of the certificate to
   become available.  The nextUpdate item is especially interesting if
   the certificate revocation status information is not available or the
   certificate is suspended.  The nextUpdate item represents the date
   and time in UTC, using the GeneralizedTime type.  The encoding rules
   for GeneralizedTime in Section 3.2.7 MUST be used.

BTW the meaning of NULL nextUpdate is clearly defined for validation policy response

   If the nextUpdate item is omitted, it indicates a non-cached response

   generated in response to a specific request (i.e., the ValPolResponse

   is bound to a specific request).  If this item is omitted, the

   requestNonce item MUST be present and MUST include the requestNonce

   value from the request.

From: Russ Housley [mailto:[email-masked]]
Sent: Thursday, April 26, 2012 12:50 PM
To: Piyush Jain
Cc: [email-masked]
Subject: Re: [pkix] SCVP : nextUpdate in CertReply

Russ

Hi All,

Thoughts?

-Piyush