Subject: Re: [pkix] What should be in "Next Update" field of the last CRL?

From: Stefan Santesson <[email-masked]>
Date: Sat, 05 Mar 2011 01:11:46 +0100

On this issue I would agree with Santosh.

This information is not useful (in any way I can think of) when validating
a certificate. If not present it obviously has no function. If present it
is always prior to revocation date. However it may be connected to the
certificate policy with respect to liability statements. Especially in
closed community applications.

/Stefan

On 11-03-01 1:12 AM, "Santosh Chokhani" <[email-masked]> wrote:

>Steve,
>
>The pro of having this feature is that archival of CRL provides you with
>something useful for investigatory purposes.
>
>-----Original Message-----
>From: Stephen Kent [mailto:[email-masked]]
>Sent: Monday, February 28, 2011 4:47 PM
>To: Santosh Chokhani
>Cc: Miller, Timothy J.; IETF PKIX
>Subject: RE: [pkix] What should be in "Next Update" field of the last CRL?
>
>At 1:38 PM -0500 2/28/11, Santosh Chokhani wrote:
>>Steve,
>>
>>Why do you think it is a bad idea?
>>
>
>because it legitimizes the notion of "whoops, I should have revoked this
>earlier, but I'm telling you now," i.e., a CRL "mulligan."
>
>For NR purposes, an RP needs to know by which time it can acquire and
>archive a CRL for future reference, in case of a dispute. As others
>have noted, we did not
>make this potentially useful info available in machine readable form,
>i.e., in an extension. So, absent that capability, I think the
>feature in question is of marginal use.
>
>An RP that knows that it needs to wait for a specified interval for
>issuance of a CRL that will, once and for all, allow the RP to act on
>a transaction does not benefit from this "feature"  if the cert in
>question is not revoked.  If the cert is retroactively revoked, but
>after the transaction date, then there is utility. But, it is not
>clear how often this situation arises, and thus whether it is worth
>the added complexity and confusion caused by the feature.
>
>Steve
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix