Subject: Re: rfc316: PKIStatus

From: Peter Sylvester <[email-masked]>
Date: Tue, 10 Jun 2003 11:45:12 +0200 (MET DST)

Welcome in the world of time stamping. 

> Hi all,
> 
> I have one question for you. I find difficulties in understanding the meaning
> of the revocationWarning PKIStatus. Indeed I wonder what this field is
> intended to mean. As reported on the rfc:
> 
>      revocationWarning      (4),
>       -- this message contains a warning that a revocation is
>       -- imminent
> 
> In details my doubts are about:
> 
> 	o What revocation is imminent (of the CA certificate? of the
> 	  TSA certificate ? or what ?). Or, this means that a new CRL is
> 	  "imminent" ?
> 
> 	o What is to be considered "imminent" ? (next few seconds, hours
> 	  or days ?)
> 
> Thanks for all the help you can give me.
> 
> -- 
> 
> Best Regards,
> 
> 	Massimiliano Pala

The definition of PKIStatus was copied unmodified from CMP
into draft version 7 of 3161, and all previous texts
explaining which fields are set etc had been simply removed.

in draft 4 one still had:

> When the PKIStatusInfo contains the value zero a Time Stamp Token is 
> present. Otherwise, the status indicates the reason why the time stamp 
> request was rejected.

and in the 

in draft 1 the text was

> PKIStatusInfo is defined in Section 3.2.3 of [RFC2510]. A valid time 
> stamp token will always have value 0 (granted) in the PKIStatus field of 
> PKIStatusInfo.  If the PKIStatus field has value `waiting' (3), then 
> this token is a receipt, as defined in Section 2.1.  Otherwise, the 
> status field is present to indicate whether or not the time stamping 
> request was fulfilled and, if not, the reason it was rejected. Since not 
> all environments will require the use of receipts, support for the value 
> `waiting' is OPTIONAL.

I cannot remember any discussion for having other values than 0 and 2
except maybe 1. 

Have fun.
Peter

---

From: Massimiliano Pala <[email-masked]>
Date: Fri, 13 Jun 2003 13:07:23 +0200

> I cannot remember any discussion for having other values than 0 and 2

Thanks for the answer, so if I got all the pieces I can simply just not
care about other vaules >2 ? Usually when I get PKIStatus <> 0 there
has been an error... so something whent wrong and the answer is to be
rejected, right ?

Anyway I would like to know, if anyone can remember, the meaning of the:

       revocationWarning      (4),

as I'd like to know what this is meant to mean :-D (if I receive a message
with this PKIStatus what am I supposed to do? what to say to the user ?
what action(s) should be taken?).

I am a little bit confused about it :-D Thanks for any help.

-- 

C'you,

	Massimiliano Pala

--o-------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                [email-masked]
                                                  Tel.:   +39 (0)59  270  094
http://www.openca.org                            Fax:    +39   178  221 8225
http://openca.sourceforge.net                    Mobile: +39 (0)347 7222 365

---

From: "Al Arsenault" <[email-masked]>
Date: Mon, 16 Jun 2003 08:23:51 -0400

Massimiliano,

The only time I ever played around with those status values was in a
previous life, implementing a pilot system for a customer who:

a - insisted on using CRLs for revocation information (actually supplemented
by OCSP, but the CRLs still had to be issued once per 24 hours); and

b - had an investigation procedure, whereby if you requested that a
certificate be revoked, e.g., because of key compromise, they wouldn't
revoke it immediately.  To defend against certain denial of service attacks
("please immediately revoke all certificates in the large-company PKI; all
the private keys are compromised"), they'd investigate to see if they should
really revoke.  So you had a gap.

For that company, we'd use code 4 to indicate either (a) the certificate had
been revoked, but hadn't yet appeared on a CRL; or (b) it was under
investigation, but hadn't been decided yet.

As for WHICH certificate, it depended on what type of message the PKIStatus
was being sent in response to.

Now, for (a) we could have used reason 5 instead of 4. And we had some
questions about whether 4 was really appropriate for (b). (How do you KNOW
that the revocation is imminent - are you guessing about the outcome of the
investigation?) We argued about it for a while. Then we gave up and ust used
reason code 2 for all rejections, and put whatever other information we
wanted the requester to know about in the message.

I'm not sure if that's what the 2510 authors had in mind, but it was the
best we could figure out at the time.

From personal experience, unless you have a real reason to use 4, 5, etc.;
I'd recommend that you just stick to reason code 2 for all rejections.

                Al Arsenault

----- Original Message -----
From: "Massimiliano Pala" <[email-masked]>
To: "Peter Sylvester" <[email-masked]>; <[email-masked]>
Sent: Friday, June 13, 2003 7:07 AM
Subject: Re: rfc316: PKIStatus

>                                                   Tel.:   +39 (0)59  270
094