Subject: SCVP RevocationInfo

From: "Covey, Carlin" <[email-masked]>
Date: Wed, 22 Nov 2000 13:52:40 -0800

Ambarish and/or Paul,

I was wondering about the interpretation of "MAY" in the following section
from draft-ietf-pkix-scvp-03.txt.  The sentence beginning "Note..." cites
one reason that the server might not use the revocation information
proffered by the client (i.e., if it is not applicable).  But I wonder if
the server is obligated to use the revocation information if it is
applicable.  For example, suppose the client proffers a recent OCSP response
that indicates that a certificate has been revoked, but the server has an
older (but not superseded) CRL that does not show the revocation.  Is the
server free to ignore the OCSP response?  This doesn't seem safe.  If the
SCVP server doesn't understand OCSP responses, must it return the response
"22  The request included unrecognized items; aborting"?  It doesn't seem
safe for the SCVP server to return "1  The request included unrecognized
items; continuing" because there doesn't appear to be a means for telling
the client which items were unrecognizable. 

- Carlin Covey
  Cylink Corp.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3.14 RevocationInfo

The RevocationInfo item specifies to the server revocation information
such as CRLs and OCSP [OCSP] responses that the server MAY use when
validating certificate chains. The purpose of the RevocationInfo item
is to provide revocation information to the server that the server may
not have access to, such as an OCSP response that the client received
along with the certificate. Note that the information in the
RevocationInfo item might not be used by the server, such as if the
information is for certificates that the server does not use in chain
building.

The types of revocation proof that can be provided are:
- CRL
- OCSP response

[[[Need to specify the format of the extensions for both CRLs and
for OCSP responses.]]]