Subject: [pkix] New Version Notification for draft-pinkas-2560bis-ocsp-locationcheck-00.txt

From: [email-masked]
Date: Tue, 25 Sep 2012 17:11:36 +0200

To the list,

The last comment from Santosh, triggered me to write a new draft proposal 
directly related to 2560bis. 

This proposal allows to split the workload of an OCSP service from a CA 
between several OCSP Responders.
This may be desirable for PKIs issuing a large number of certificates 
(e.g. several hundred of thousands).

Denis 

==============================================================================================

A new version of I-D, draft-pinkas-2560bis-ocsp-locationcheck-00.txt
has been successfully submitted by Denis Pinkas and posted to the
IETF repository.

Filename:                draft-pinkas-2560bis-ocsp-locationcheck
Revision:                00
Title:           OCSP LocationCheck certificate extension Update to OCSP 
                   < draft-pinkas-2560bis-ocsp-locationcheck-00.txt >
Creation date:            2012-09-25
WG ID:                            Individual Submission
Number of pages: 6
URL:             
http://www.ietf.org/internet-drafts/draft-pinkas-2560bis-ocsp-locationcheck-00.txt

Status:          
http://datatracker.ietf.org/doc/draft-pinkas-2560bis-ocsp-locationcheck
Htmlized:        
http://tools.ietf.org/html/draft-pinkas-2560bis-ocsp-locationcheck-00

Abstract:

   RFC 2560 [RFC2560] allows CAs to designate one or more OCSP
   Responders for being responsible to provide the revocation status
   of the certificates they issue under a given CA key.

   This document introduces a new feature that allows allows CAs to
   split the workload between different sets of OCSP Responders in a
   way that is analogous to the way CRLs can be split between
   different sets of CRL issuers (using the cRLDistributionPoints
   extension).

   This new feature allows a CA to designate one or more OCSP
   Responders for being responsible to provide the revocation status
   for a subset of the certificates they issue under a given CA key.

   This document defines a critical extension that may only be placed
   in an OCSP certificate and the way it shall be processed by OCSP
   clients.

The IETF Secretariat

---

From: Santosh Chokhani <[email-masked]>
Date: Fri, 28 Sep 2012 10:17:57 -0400

Denis,

I find the document in general acceptable.  It definitely fills a hole.

That said, it is effective both in general and against MITM attack if the CA recognizes that the absence of the critical extension you designed in the OCSP certificate means that the Responder is authoritative for all certificates as long as the rest of the requirements in RFC 2560 are met.

Note that absence of IDP means that the CRL is full and complete.  We do not have a similar statement in 2560 and this extension is fully effective only if such is the case, i.e., by omitting this extension, the CA implies that the Responder is authoritative for all certificates signed using that CA key.

We either need to impose this requirement, which while new, most implementations I know impose or discuss it in the Security Considerations section.

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Tuesday, September 25, 2012 11:12 AM
To: pkix
Subject: [pkix] New Version Notification for draft-pinkas-2560bis-ocsp-locationcheck-00.txt

To the list,

The last comment from Santosh, triggered me to write a new draft proposal directly related to 2560bis.

This proposal allows to split the workload of an OCSP service from a CA between several OCSP Responders.
This may be desirable for PKIs issuing a large number of certificates (e.g. several hundred of thousands).

Denis

Filename:                 draft-pinkas-2560bis-ocsp-locationcheck
Revision:                 00
Title:                 OCSP LocationCheck certificate extension Update to OCSP
                  < draft-pinkas-2560bis-ocsp-locationcheck-00.txt >
Creation date:                  2012-09-25
WG ID:                                   Individual Submission
Number of pages: 6
URL:             http://www.ietf.org/internet-drafts/draft-pinkas-2560bis-ocsp-locationcheck-00.txt
Status:          http://datatracker.ietf.org/doc/draft-pinkas-2560bis-ocsp-locationcheck
Htmlized:        http://tools.ietf.org/html/draft-pinkas-2560bis-ocsp-locationcheck-00

Abstract:

The IETF Secretariat