Subject: [pkix] I-D Action: draft-ietf-pkix-rfc2560bis-20.txt

From: [email-masked]
Date: Mon, 15 Apr 2013 09:30:23 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

	Title           : X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
	Author(s)       : Stefan Santesson
                          Michael Myers
                          Rich Ankney
                          Ambarish Malpani
                          Slava Galperin
                          Carlisle Adams
	Filename        : draft-ietf-pkix-rfc2560bis-20.txt
	Pages           : 44
	Date            : 2013-04-15

Abstract:
   This document specifies a protocol useful in determining the current
   status of a digital certificate without requiring CRLs. Additional
   mechanisms addressing PKIX operational requirements are specified in
   separate documents. This document obsoletes RFC 2560 and RFC 6277,
   and updates RFC 5912.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-pkix-rfc2560bis

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-pkix-rfc2560bis-20

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-pkix-rfc2560bis-20

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Peter Rybar" <[email-masked]>
Date: Tue, 16 Apr 2013 09:04:49 +0200

Stefan,
Is it possible to add in the Clause 7.2. "Informative References"
"
[CoPKI]  T7 e.V.:  Common PKI Specifications for Interoperable 
Applications; Version 2.0, 20 January 2009
"

And in the Clause 2.2 "Response" add before the first sentence in the NOTE text:
"
NOTE: The "good" status and the "revoked" status may include in the SingleResponse singleExtensions CertHash [CoPKI] (Positive Statement) {1 3 36 8 3 13} the responder may include this extension in a response to send the hash of the requested certificate to the requestor. This hash serves as evidence that the certificate is known to the responder (i.e. it is available in the queried directory) and will be used as means to provide a positive statement of availability.
" The "revoked" status indicates that a certificate with the ...

Such text will be helpful to inform implementers about this extension which is important especially for the "good" status and is defined outside of this RFC.

Peter Rybar

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, April 15, 2013 6:30 PM
To: [email-masked]
Cc: [email-masked]
Subject: [pkix] I-D Action: draft-ietf-pkix-rfc2560bis-20.txt

Abstract:

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 16 Apr 2013 10:10:34 +0200

We can't include a reference to a private extension at this stage that has
not been reviewed by the WG.

That does not prevent this extension from being used.
Or the IETF from defining a similar extension, possibly based on the one
you reference.

/Stefan

On 4/16/13 9:04 AM, "Peter Rybar" <[email-masked]> wrote:

>NOTE: The "good" status and the "revoked" status may include in the
>SingleResponse singleExtensions CertHash [CoPKI] (Positive Statement) {1
>3 36 8 3 13} the responder may include this extension in a response to
>send the hash of the requested certificate to the requestor. This hash
>serves as evidence that the certificate is known to the responder (i.e.
>it is available in the queried directory) and will be used as means to
>provide a positive statement of availability.
>Such text will be helpful to inform implementers about this extension
>which is important especially for the "good" status and is defined
>outside of this RFC.
>
>Peter Rybar
>