Subject: RE: Certificate Hold (was RE: delta CRLs)

From: "Housley, Russ" <[email-masked]>
Date: Mon, 07 May 2001 13:13:39 -0400

Tom:

I have not been able to make myself clear.  Perhaps because you keep 
looking to simple authentication applications.  My hope is that the PKIX 
profile will readily meet the needs of these relatively straightforward 
applications and also support the more demanding needs of applications 
where non-repudiation is needed.

All:

My view of the question is that three people have voiced a desire to see 
the suspension feature removed, one is asking questions without voicing a 
position, and no one has asked to keep it.  People who have an opinion but 
have not posted it yet please do so.

Russ

At 11:32 AM 5/7/2001 -0400, Tom Gindin wrote:

>      I don't actually think that "removeFromCRL" is unduly complex, nor did
>I say so.  What I wanted to point out was that when delta CRL's are not in
>use the "certificateHold" reason adds no extra complexity to standard CRL
>processing at all (exclusive of NR, which is not a simple case), and
>therefore I can't understand why anyone would want to deprecate that
>reason.
>
>           Tom Gindin
>
>
>Santosh Chokhani <[email-masked]> on 05/05/2001 07:58:09 AM
>
>To:   Tom Gindin/Watson/IBM@IBMUS, Stephen Kent <[email-masked]>
>cc:   "Housley, Russ" <[email-masked]>, [email-masked]
>Subject:  RE: Certificate Hold (was RE: delta CRLs)
>
>
>Tom:
>
>
>I also am not a fan of "hold: feature.  But, I fail to see why
>"removeFromHold" is in delta CRL is unduly complex.  I would say either not
>have the "hold" feature or require "hold' and "release" irrespective of
>delta.
>
>
>-----Original Message-----
>From: Tom Gindin [mailto:[email-masked]]
>Sent: Friday, May 04, 2001 6:50 PM
>To: Stephen Kent
>Cc: Housley, Russ; [email-masked]
>Subject: RE: Certificate Hold (was RE: delta CRLs)
>
>
>
>
>
>
>      I don't know why this particular feature is so unpopular.  I can
>understand why handling "removeFromCRL" in deltas could be an extra load on
>
>clients, but wouldn't the maximum remedy for that be to say that CA's which
>
>issue delta CRL's SHOULD NOT use hold, while RP's MAY process
>removeFromCRL?  What extra complexity does hold add to an RP for a CA which
>
>doesn't issue deltas but issues full CRL's (perhaps full distribution point
>
>CRL's) instead?
>
>
>           Tom Gindin
>
>
>
>
>
>Stephen Kent <[email-masked]> on 05/04/2001 02:42:33 PM
>
>
>To:   "Housley, Russ" <[email-masked]>
>cc:   [email-masked]
>Subject:  RE: Certificate Hold  (was RE: delta CRLs)
>
>
>
>
>
>At 1:30 PM -0400 5/4/01, Housley, Russ wrote:
> >Carlin:
> >
> >>Russ, it appears from your comment:
> >>"Fair reply.  And, unless there is a ground swell of
> >>support, I will drop it."
> >>that you have interpreted Denis as meaning
> >>"I have withdrawn my support for 'hold'."
> >>
> >>Russ, is that correct?
> >>
> >>And Russ, I am further confused by "... I will drop it."
> >>
> >>Did you mean that you will add text to prohibit compliant
> >>CA's from issuing delta CRL's that include "hold" and
> >>"removeFromCRL" reason codes or text that will prohibit
> >>this for full CRL's as well as delta-CRLs, or did you
> >>mean something else entirely?
> >
> >I have NEVER liked the on-hold feature.  I still do not like the
> >on-hold feature.
> >
> >I will not delay the Last Call process on son-of-rfc 2459 to debate
> >the issue unless I see that there are others that support my view.
>
>
>I feel the same as Russ, i.e., have never liked it and still think
>it's a bad idea. Since we deprecated the hold instruction (vis our
>comments on the hold instruction code entry extension) last time, is
>there are basis for change this time around?
>
>
>Steve

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 7 May 2001 15:41:49 -0700

> From: Housley, Russ [mailto:[email-masked]]
> On Monday, May 07, 2001 10:14 AM, Russ asked:
>
> . . .
>
> All:
>
> position, and no one has asked to keep it.  People who have an
> opinion but have not posted it yet please do so.

Towards consensus, I agree to the removal of the CRL-based suspension
feature.  Suspension requirements are still important but PKIX has devised a
means via OCSP of more effectively addressing this need.

Mike

---

From: "Carlin Covey" <[email-masked]>
Date: Mon, 7 May 2001 16:14:29 -0700

I cast a vote for altering the wording of the PKIX profile
to deprecate the use of certificate suspension via CRLs.

-  Carlin Covey
   Cylink Corporation

-----Original Message-----
From: Michael Myers [mailto:[email-masked]]
Sent: Monday, May 07, 2001 3:42 PM
To: [email-masked]
Subject: RE: Certificate Hold (was RE: delta CRLs)

Mike

---

From: "Al Arsenault" <[email-masked]>
Date: Tue, 8 May 2001 07:47:23 -0400

I cast a vote identical to Carlin's.

        Al Arsenault
        Chief Security Architect
        Diversinet Corp.