Subject: RE: Comment on RFC 3280bis: id-pkix-crl-nocheck extension

From: "Santosh Chokhani" <[email-masked]>
Date: Sun, 9 Jul 2006 10:05:12 -0700

Russ,

I would support such an extension if the purpose, utility, and drawbacks
were explained.

It is a new capability, but is better than self-issued certificates
running amok.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Russ Housley
Sent: Sunday, July 09, 2006 10:18 AM
To: [email-masked]
Subject: Re: Comment on RFC 3280bis: id-pkix-crl-nocheck extension

Denis:

>We currently have id-pkix-ocsp-nocheck extension.
>
>In order to support trust anchors that issue short-lived PKCs for 
>CRL issuers,
>there is a need to create a id-pkix-crl-nocheck extension.

id-pkix-ocsp-nocheck is not discussed in 3280 or 3280bis.  So, I do 
not understand why you think the proposed extension ought to be added 
to 3280bis.  Perhaps it belongs in another document.  From my 
perspective, it is not clear that there is consensus for a 
id-pkix-crl-nocheck extension.  Adding it without confirming that 
there is consensus is a very big concern.

If 3280bis goes forward without a id-pkix-crl-nocheck extension, a 
separate document can be written to address this topic.  Using a 
separate document allows us to easily determine consensus.

Russ