Subject: OCSP RFC and OCSP version 2 ID

From: Santosh Chokhani <[email-masked]>
Date: Tue, 15 Jan 2002 19:41:33 -0500

Folks:

I am looking at both the RFC and version 2 ID for OCSP.  Each document
contains statements that seem contradictory to me.  This relates to the
meaning of nextUpdate field in the OCSP SingleResponse.  Some places each
document states that:

"If nextUpdate is not set, the responder is indicating that newer revocation
information is available all the time"

Other places each document states that:

"Responses where the nextUpdate value is not set are equivalent to a CRL
with no time for nextUpdate"

Now, this appear contradictory to me since I do not interpret X.509 to imply
that absence of nextUpdate field in CRL means near real-time CRL generation.

I assume that the above is editorial oversight and the authors of both the
RFC and ID mean that for OCSP, absence of nextUpdate means newer revocation
information is available all the time.

Raccoon Eyes

Santosh Chokhani
CygnaCom Solutions, Inc.
7927 Jones Branch Drive, Suite 100 West
McLean, VA 22102
[email-masked]
(703) 270-3520  (703) 848-0960 (fax)
www.cygnacom.com

Entrust CygnaCom

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 16 Jan 2002 09:04:42 +0100

Santosh,

> "If nextUpdate is not set, the responder is indicating that newer
> revocation information is available all the time"
> 
> Now, this appear contradictory to me since I do not interpret X.509 to
> imply that absence of nextUpdate field in CRL means near real-time CRL
> generation.
> 
> RFC and ID mean that for OCSP, absence of nextUpdate means newer
> revocation information is available all the time.

The OCSP RFC advertises thisUpdate and nextUpdate as:

   - thisUpdate: The time at which the status being indicated is known
                 to be correct

   - nextUpdate: The time at or before which newer information will be
                 available about the status of the certificate

At the time the document was written, the main mechanism to feed the
information to the OCSP server was to use CRLs. So it seems sensible to
think that these fields are copied from a CRL.

So I would say that "responses where the nextUpdate value is not set are
equivalent to a CRL with no time for nextUpdate" is the correct
interpretation.

Now the text could be clarified to say what this really means !

Section 5.1.2.5 (Next Update) from PKIX Part 1 does not say a word in that
case.

The general response is the "certificate policy will tell", in the same way
that when some extensions are absent, e.g. the CRL Distribution points, the
certificate policy will tell.

So I would certainly not interpret it as: "If nextUpdate is not set, the
responder is indicating that newer revocation information is available all
the time".

Denis