Subject: Re: [pkix] New version Notification for draft-pinkas-2560bis-certinfo-00

From: Santosh Chokhani <[email-masked]>
Date: Tue, 4 Sep 2012 21:56:06 -0400

Denis,

I have couple of suggestions for the security considerations section.

1.     It is worth pointing out aside from RA corruption and database corruption that recommendation here do not fix the situation if the adversary has attacked the CA and pointed to its own OCSP Responder in the OCSP field of the AIA extension.

2.     It is worth pointing out that the mechanism presented here can be used by the relying party to detect collision if the certificate signature was made using a weak hash, but the hashAlgorithm in the extension is not vulnerable to successful collision attack.

Thanks
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, August 31, 2012 6:17 AM
To: IETF PKIX
Subject: [pkix] New version Notification for draft-pinkas-2560bis-certinfo-00

A new version of I-D, draft-pinkas-2560bis-certinfo-00.txt
has been successfully submitted by Denis Pinkas and posted
to the IETF repository.

Filename: draft-pinkas-2560bis-certinfo
Revision: 00
Title: CertInfo single response extension Update to OCSP < draft-pinkas-2560bis-certinfo-00.txt >
Creation date: 2012-08-31
WG ID: Individual Submission
Number of pages: 7
URL:             http://www.ietf.org/internet-drafts/draft-pinkas-2560bis-certinfo-00.txt
Status:          http://datatracker.ietf.org/doc/draft-pinkas-2560bis-certinfo
Htmlized:        http://tools.ietf.org/html/draft-pinkas-2560bis-certinfo-00

Abstract:
   OCSP [RFC2560] has been designed to allow an OCSP server to use
   any kind of trustable information to answer to a client varying
   from CRLs to an access to a database of issued certificates.

   In its original version, OCSP does not allow taking full advantage
   of an access to a database of issued certificates.

   When a database of issued certificates is used by an OCSP server,
   this document explains how the OCSP server shall respond and how
   OCSP clients shall react.

   The proposal is intended to update 2560bis. It defines a new single
   extension in a single response, called certInfo.  The extension is
   non critical.  The meaning of "good", "revoked" and "unknown" are
   unchanged.

The IETF Secretariat