Subject: RE: Minor OID mistakes in OCSPv2 and the official OID list

From: "Michael Myers" <[email-masked]>
Date: Tue, 29 May 2001 14:13:42 -0700

Russ,

Good to hear of this.  Thanks.  Any chance for an Informational I-D laying
out the OID structure?  I'm willing to help.

Mike

Michael Myers
t: +415.819.1362
e: mailto:[email-masked]
w: http://www.traceroutesecurity.com

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Tuesday, May 29, 2001 1:05 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: RE: Minor OID mistakes in OCSPv2 and the official OID list
>
>
> Mike:
>
> Temporal Data Authority (TDA) has disappeared from the TSP
> document. So, no
> OID is needed for it, and it can be re-assigned. We got luckly this time,
> so I did the reassignment.
>
>       id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
>
> Please help avoid future collisions!  In the future, any PKIX document
> editor that needs an OID, please send mail to
> [email-masked] to
> request it.  Do not make a guess at the value that might be assigned!
>
> Regards,
>    Russ
>
>  > >From: "Michael Myers" <[email-masked]>
>  > >To: <[email-masked]>, <[email-masked]>,
>  > >         <[email-masked]>, <[email-masked]>
>  > >Subject: RE: Minor OID mistakes in OCSPv2 and the official OID list
>  > >Date: Fri, 18 May 2001 13:01:16 -0700
>  > >X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
>  > >Importance: Normal
>  > >Sender: [email-masked]
>  > >List-Archive: <http://www.imc.org/ietf-pkix/mail-archive/>
>  > >List-ID: <ietf-pkix.imc.org>
>  > >List-Unsubscribe: <mailto:[email-masked]?body=unsubscribe>
>  > >List-ID: <ietf-pkix.imc.org>
>  > >
>  > >
>  > >On Saturday, May 19, 2001, at the inspiring hour of 3:30 AM,
> Peter Gutman
>  > >advised:
>  > >
>  > > > Given that there are already certs (and lots of software)
>  > > > out there which use the current OID, wouldn't it be better
>  > > > to relocate temporalDataAuthority (what is that anyway?
>  > > > Does anyone use it? It looks like an oddly-named TSA OID).
>  > > >
>  > > > (Given that the OCSP OID is already in active use, I suspect
>  > > > {id-kp 9} will remain "the OCSP OID" even if it's officially
>  > > >  reassigned, this my comment that it's going to be easier for
>  > > > Mohammed to go to the mountain).
>  > > >
>  > > > Peter.
>  > >
>  > >Peter,
>  > >
>  > >Certainly a more pragmatic approach.  As a consequence I've
> spent some time
>  > >today searching across the various current and historical IETF work
> products
>  > >to do kind of an environmental impact assessment of simply
> re-labelling
>  > >{id-kp 9} from "id-kp-temporalDataAuthority" to "id-kp-OCSPSigning".
>  > >
>  > >As it turns out, the notion of a Temporal Data Authority (TDA) and a
>  > >corresponding {id-kp 9} definition was introduced at least by
>  >
> >http://www.ietf.org/proceedings/99jul/I-D/draft-ietf-pkix-time-stamp-02.
> txt.
>  > >However, by the -14 edition the concept went away:
>  > >http://www.ietf.org/internet-drafts/draft-ietf-pkix-time-stamp-14.txt.
>  > >
>  > >So the path seems clear to redefine {id-kp 9} as
> id-kp-OCSPSigning with no
>  > >impact to timestamping implementors.  Doing so would benefit
> standing OCSP
>  > >implementations but does not excuse the OCSP authors, myself
> included, from
>  > >a swift kick in the butt for failing to coordinate across the
> WG on this
>  > >point.
>  > >
>  > >Incidentally, it might be useful to produce the relevant OID
> list into a
>  > >PKIX work product so that once PKIX wraps clues are left
> behind how the
>  > >pieces are supposed to bolt together.
>  > >
>  > >Mike
>  > >
>  > >
>  > >Michael Myers
>  > >t: +415.819.1362
>  > >e: mailto:[email-masked]
>  > >w: http://www.traceroutesecurity.com
>

---

From: "Housley, Russ" <[email-masked]>
Date: Tue, 29 May 2001 17:32:03 -0400

Mike:

This seems like a reasonable thing to do as the PKIX WG is winding 
down.  Is there really any point in a document that documents the current 
snapshot?

Russ

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 29 May 2001 15:38:20 -0700

I think so Russ.  At a minimum we need to leave behind a highly visible and
definitive OID structure.  In my opinion PKIX isn't done until we document
all that we've defined.

Mike

Michael Myers
t: +415.819.1362

> From: Housley, Russ [mailto:[email-masked]]
> Sent: Tuesday, May 29, 2001 2:32 PM
> To: Michael Myers
> Cc: Russ Housley; [email-masked]
> down.  Is there really any point in a document that documents the
> current snapshot?
>
> Russ
>
> >Good to hear of this.  Thanks.  Any chance for an Informational
> >I-D laying out the OID structure?  I'm willing to help.
> >
> >Mi

---

From: "Housley, Russ" <[email-masked]>
Date: Thu, 31 May 2001 15:05:36 -0400

I can certainly publish the OID list periodically in an I-D.  Say every six 
months. In the I-D, I can say that the files on the IMC web site are 
updated more frequently.  Are there document editors that do not know this 
already?

Russ

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 31 May 2001 14:44:32 -0700

Russ,

I (and I hope others too) deeply appreciate what Paul's doing for us but in
the longer run I'm little bit concerned of direct linkage to a potentially
ephemeral Web site.  I recall my aggravation years ago at having to hunt
down authoritative references to OIW OIDs.

Mike

Michael Myers
t: +415.819.1362

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Housley, Russ
> Sent: Thursday, May 31, 2001 12:06 PM
> To: Michael Myers
> Cc: [email-masked]

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 31 May 2001 17:48:23 -0700

>down authoritative references to OIW OIDs.

So, you got a few choices:

- Let { Paul | Tim | Steve | Russ | Peter :-) | someone } keep it on 
a web site that is hopefully well-known

- Put it in an Internet Draft that has to be updated at least every 
six months and is hopefully well-known

- Put it into an RFC that will be well-known but won't change

- Make it an IANA registry

The last one is preferable, if and only if we can come up with a 
clear and sensible mechanism for IANA to follow. That is the 
difficult part. This thread shows exactly how hard it is. The IANA 
folks are good record keepers, and they don't know diddly about ASN.1 
or PKIX, nor do they want to learn about it.

Probably the best way to let IANA run it is to have them not do the 
management, but to have an "OID reviewer" run a mailing list and that 
person is the only one who can tell IANA how the registry should 
change. This is essentially what we are doing now, except that the 
registry is on a web server somewhere, not at IANA. At the point we 
think the registry is well-cooked, someone must write an Internet 
Draft with the IANA rules, have it cycle here in the WG for a while, 
and eventually become an RFC. At that point, the registry goes to 
IANA.

Do we think we are ready enough for that yet?

--Paul Hoffman, Director
--Internet Mail Consortium