Subject: Minor OID mistakes in OCSPv2 and the official OID list

From: Jeff Jacoby <[email-masked]>
Date: Thu, 17 May 2001 09:21:35 -0700

Greetings,

I believe there are two minor mistakes (or maybe just typos) in 
the OCSPv2 draft (draft-ietf-pkix-ocspv2-02) and in the "Official" 
list of PKIX OIDs.

1. Througout the draft are references to id-kp-OCSPSigning as
   
    id-kp-OCSPSigning OBJECT IDENTIFIER ::= {id-kp 9}

   However, in the official list, (id-kp 9) is something
   called id-kp-temporalDataAuthority

    id-kp-temporalDataAuthority  OBJECT IDENTIFIER ::= { id-kp 9 }

   Is this a mistake in the list document?

2. In section 3.4 of the draft (and this was true in the equivilent
   section in 2560) there are two references to "id-ad-ocspSigning"
   There is no such id in the list of PKIX OIDs.

   Is this just a typo in the draft, and that id-kp-OCSPSigning was
   intended?

Regards,

Jeff
   
-- 
Jeff Jacoby, Sr. Programmer
RSA Security Inc., SMDC

2755 Campus Dr., Ste. 300       [email-masked]
San Mateo, CA  94403            (650) 295-7569

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 17 May 2001 17:55:59 -0700

Jeff,

Thanks for the catch.  Yes, clearly the OID {id-kp 9} was assigned to
id-kp-temporalDataAuthority for EKU.  In coordination with the PKIX OID
Registrar and the IESG, we will correct this defect with the result of a new
OID for id-kp-OCSPSigning for use in EKU.

BTW, are you and/or your interoperability partners facing a need that
depends upon this feature?

Mike

---

From: Jeff Jacoby <[email-masked]>
Date: Fri, 18 May 2001 10:49:47 -0700

Mike,

> OID for id-kp-OCSPSigning for use in EKU.

If it's possible, I would prefer id-kp-OCSPSigning remain as {id-kp 9}
and 
that id-kp-temporalDataAuthority (whatever that is) be {id-kp
somethingelse}

> depends upon this feature?

We determine the response signer is an authorized signer (as opposed to 
a trusted signer) based on the presense of that OID (id-kp 9) in the 
response signer's cert.  This significantly affects how our client
validates 
the signer.  I know of at least one VA vendor that, so far, has used 
{id-dp 9} so we would have to be able to handle 2 possible values if 
id-kp-OCSPSigning gets a new value.

Jeff