Subject: [Gen-art] Review: draft-ietf-pkix-lightweight-ocsp-profile-09.txt

From: Lucy Lynch <[email-masked]>
Date: Tue, 17 Apr 2007 12:55:46 -0700 (PDT)

I am the assigned Gen-ART reviewer for: 
draft-ietf-pkix-lightweight-ocsp-profile-08.txt

For background on Gen-ART, please see the FAQ at 
<http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html>. Please resolve 
these comments along with any other Last Call comments you may receive.

Note that since assignment this document was updated to: 
draft-ietf-pkix-lightweight-ocsp-profile-09.txt and I reviewed the v.09

This draft is basically ready for publication, but has nits that should be 
fixed before publication.

Nits Outstanding:

** Obsolete normative reference: RFC 2246 (ref. 'TLS')
    (Obsoleted by RFC 4346)
** Obsolete normative reference: RFC 3546 (ref. 'TLSEXT')
    (Obsoleted by RFC 4366)

There is a direct reference to "3.6. Certificate Status Request" 
in RFC 3546 inline in the text but a diff on sec 3.6 in 3546 vs 4366 shows 
only a few changes in punctuation and line breaks (see attached). Is there 
a reason why these Refs have not been updated?

History:

The last substantive discussions of this draft on the WG list happened in 
2004.

A Last Call Notice was posted Thu, 15 Jun 2006 (v.05) and Ron Bonica 
reviewed the document at that time: 
http://www.alvestrand.no/ietf/gen/reviews/draft-ietf-pkix-lightweight-ocsp-profile-05-bonica.txt 
At that time the document was tagged as Informational. The document moved 
to "Proposed Standard" with v.07.

There have been several DISCUSS tokens set on this document and the 
tracker doesn't show the final resolution but given that Sam and Russ are 
still sitting, I'll assume that their concerns have been addressed. I note 
that David Kessens flagged the use of SHA1 as a requirement in a comment 
and I'm guessing that a change in that requirement would require an 
amendment to the current document if it advances to standard.

Review Comments:

One small area of confusion. Is there a potential for a gap in timely 
update given both a "tolerance period" (sec 3) and "using the 
cache-control:max-age directive (sec 5.1) in time-based calculations ??? 
Sorry if I'm being dense here.

Revision Only Comments:

If/when the document gets another revision, two small changes in sec. 
1.2.1 OCSPResponse Structure

   "In the case a responder does not have the ability to respond"
               ^ where

and

   "case a responder only"
        ^ where

Other Remarks:

Learn something new every time: sec 5 "aka stapling". Cool.

- Lucy

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art

---

From: Lucy Lynch <[email-masked]>
Date: Wed, 18 Apr 2007 15:29:13 -0700 (PDT)

On Wed, 18 Apr 2007, Deacon, Alex wrote:

> Hi Lucy,
>
> I'll post -10 this afternoon.  Comments in line....

nice!

<snip>

>> Review Comments:
>>
>> One small area of confusion. Is there a potential for a gap
>> in timely update given both a "tolerance period" (sec 3) and
>> "using the cache-control:max-age directive (sec 5.1) in
>> time-based calculations ???
> The requirement for timely updates of OCSP responses falls on the OCSP
> responder.  The requirement in 5.1 simply ensures that the responder
> actually have a newly minted response available before clients starting
> asking for updates.   The requirement for the client is to properly
> validate the signed response taking into account any (optional)
> tolerance period as described in section 3.  There should not be a gap,
> but in the case there is it will be detected by the client upon
> proper/standard ocsp response validation.

makes complete sense when you put it that way...

> Great!  Thanks again.

thanks for the quick update.

cheers -

> Alex

---

From: "Deacon, Alex" <[email-masked]>
Date: Wed, 18 Apr 2007 15:20:16 -0700

Hi Lucy,

> -----Original Message-----
> From: Lucy Lynch [mailto:[email-masked]] 
> Sent: Tuesday, April 17, 2007 12:56 PM
> To: [email-masked]; Russ Housley
> Cc: Deacon, Alex; [email-masked]; [email-masked]; 
> [email-masked]
> Subject: Review: draft-ietf-pkix-lightweight-ocsp-profile-09.txt
> 
> <http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html>. 
> Please resolve these comments along with any other Last Call 
> comments you may receive.
> 
> This draft is basically ready for publication, but has nits 
> that should be fixed before publication.
> 
> Nits Outstanding:
> 
> in RFC 3546 inline in the text but a diff on sec 3.6 in 3546 
> vs 4366 shows only a few changes in punctuation and line 
> breaks (see attached). Is there a reason why these Refs have 
> not been updated?

I've created a -10 rev and have updated these references. 

> 
> History:
> 
> The last substantive discussions of this draft on the WG list 
> happened in 2004.
> 
> A Last Call Notice was posted Thu, 15 Jun 2006 (v.05) and Ron 
> Bonica reviewed the document at that time: 
> At that time the document was tagged as Informational. The 
> document moved to "Proposed Standard" with v.07.
> 
> There have been several DISCUSS tokens set on this document 
> and the tracker doesn't show the final resolution but given 
> that Sam and Russ are still sitting, I'll assume that their 
> concerns have been addressed. I note that David Kessens 
> flagged the use of SHA1 as a requirement in a comment and I'm 
> guessing that a change in that requirement would require an 

>    "In the case a responder does not have the ability to respond"

OK.  I've fixed these.  

Great!  Thanks again.

Alex