Subject: Comment on RFC 3280bis: id-pkix-crl-nocheck extension

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 4 Jul 2006 14:57:09 +0200

We currently have id-pkix-ocsp-nocheck extension.

In order to support trust anchors that issue short-lived PKCs for CRL issuers, 
there is a need to create a id-pkix-crl-nocheck extension.

Denis

---

From: Russ Housley <[email-masked]>
Date: Sun, 09 Jul 2006 10:17:34 -0400

>there is a need to create a id-pkix-crl-nocheck extension.

id-pkix-ocsp-nocheck is not discussed in 3280 or 3280bis.  So, I do 
not understand why you think the proposed extension ought to be added 
to 3280bis.  Perhaps it belongs in another document.  From my 
perspective, it is not clear that there is consensus for a 
id-pkix-crl-nocheck extension.  Adding it without confirming that 
there is consensus is a very big concern.

If 3280bis goes forward without a id-pkix-crl-nocheck extension, a 
separate document can be written to address this topic.  Using a 
separate document allows us to easily determine consensus.

Russ

---

From: David Cross <[email-masked]>
Date: Sun, 9 Jul 2006 09:35:27 -0700

Denis:

I agree that could be a very valuable extension given the recent trend of systems and applications issuing short lived certificates for the purpose of authentication.  I don't believe it should hold up RFC3280bis though.

David B. Cross

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
Sent: Tuesday, July 04, 2006 5:57 AM
To: [email-masked]
Subject: Comment on RFC 3280bis: id-pkix-crl-nocheck extension

In order to support trust anchors that issue short-lived PKCs for CRL issuers, there is a need to create a id-pkix-crl-nocheck extension.

Denis