Subject: RE: OCSP request

From: Simon Tardell <[email-masked]>
Date: Tue, 25 Jul 2000 16:41:22 +0200

> > The problem is that OCSP does not tell you whether the 
> certificate was already
> > issued at the time of the signature. It only says it was 
> not revoked.
> 
> Depends on the OCSP implementation.  Some (e.g., Valicert 
> last I looked)
> can only say "not revoked" while some (e.g., CertCo last I looked) can
> also say "not known"

The problem with the OCSP protocol is that there are three non-orthogonal
answers: good, revoked, unknown. It'd all be well if "good" was identical to
"not revoked" and "unknown" meant "I can't tell if it is either, go ask
someone else, or come back later, I might find out". But that is not the way
it is expressed in the RFC. In the RFC "good" is an assertion that A && B &&
C .. any number of conditions is true, while revoked only means !B and
unknown could be interpreted to mean !C ("I KNOW this cert was never
issued"). Different groups have different requirements and will want to
include different assertions in OCSP or something very similar (e.g. some
want to assert that a cert was ever issued) in a way that will make the
clients un-interoperable. That is, they will comply in the sense that the
bits on the wire are the same, but the intended interpretation is different.
Since end-users may very well be members of different PKIs this is
unfortunate. 

Simon.

Simon Tardell, Software Architect, iD2 Technologies
voice +46 8 7755225, fax +46 8 7267912, cell +46 70 3198319
[email-masked], http://www.iD2tech.com
Securing the Internet economy

---

From: Jonathan Sowler <[email-masked]>
Date: Tue, 25 Jul 2000 16:43:59 +0100

Good point - the language consistently causes a problem - "good" implies some
sort of judgement that you can take proceed with a transaction/session based on
the status of the certificate.   It would be good to define the response "issued
and not revoked" and avoid more loaded terms - as dull as it may make reading
PKIX specs!  If a certificate has been revoked and the reason for revocation is
benign,  I may still chose to proceed with a signed transaction on the basis
that there is minimal risk to me - i.e. interpret the OCSP response as good.

--

Best Regards,

Jonathan Sowler
Product Management Group

-------------------------------------------------------------
-------------------------------------------------------------

TRUSTBASE HAS MOVED!!  The new contact details are:

For more information about iPlanet's Trustbase products visit:
http://www.trustbase.com

iPlanet Electronic Commerce Solutions       Tel: +44 (0) 20 7337 9200
A Sun-Netscape Alliance                     Ext: 29916
Equitable House        Fax: +44 (0) 20 7337 9201
47/51 King William Street      E-Mail: [email-masked]
London
EC4R 9AF
United Kingdom

-------------------------------------------------------------

"Trust only those who stand to lose as much as you when things go wrong."

Bralek's Rule for Success, in Arthur Bloch, comp.
"Expertsmanship," Murphy's Law: Book Three, 1982

-------------------------------------------------------------