Subject: RE: Reason codes vs Reason flags

From: Carlisle Adams <[email-masked]>
Date: Thu, 14 Jan 1999 10:29:36 -0500

Hi Al,

You're going back a long way and really taxing my memory here...  :-)

I inherited CMP (then called PKIX Part 3) very shortly after its first
appearance as a separate document (i.e., there was initially a single PKIX
document, which was quickly separated into four parts and I got involved
just after that point).  If I remember correctly, the ReasonFlags structure
was already in Part 3, pulled in from Part 1.  It never really occurred to
me to question this, or to change it to reasonCode, so it stayed (because it
seemed to work).  Apparently, it never occurred to anyone else to question
this either, until recently.

Carlisle.

P.S., I agree with your earlier comments, Al, regarding the lateness of the
hour.  CMP has already been approved by the IESG and we're just waiting for
the announcement from the RFC editor that the document is available.  If we
ever have a CMPv2, or if we ever decide to try to progress this
specification to Draft Standard, we can fix these sorts of things then.

-----Original Message-----
From: Al Arsenault [mailto:[email-masked]]
Sent: Thursday, January 14, 1999 8:03 AM
To: Carl Wallace; ietf-pkix
Cc: [email-masked]; [email-masked]
Subject: Re: Reason codes vs Reason flags

At 10:18 PM 1/13/99 -0500, Carl Wallace wrote:
>Why not use the reasonCode extension in the crlEntryDetails field and
>eliminate the revocationReason field all together?  Same goes for the
>invalidityDate extension and badSinceDate field.
>

I think that makes three of us so far that agree with that approach.  

Carlisle & Stephen,

	Any comments as to why you chose the ReasonFlags structure in
section
3.3.9 of CMP, vice CRLReason?

---

From: "Carl Wallace" <[email-masked]>
Date: Thu, 14 Jan 1999 11:35:31 -0500

Also, what should a CA do if it receives a request with information in the
revocationReason field or badSinceDate field and in the corresponding
extensions of the crlEntryDetails field?

-----Original Message-----
From: [email-masked] <[email-masked]>
To: Carlisle Adams <[email-masked]>
Cc: ietf-pkix <[email-masked]>
Date: Thursday, January 14, 1999 11:15 AM
Subject: RE: Reason codes vs Reason flags

>Carlisle,
>Can you offer an alternative from John's list (or yet another
>one) about what to do about the mismatch then? As a refresher,
>he said:
>
>What should a CA do if it receives a CMP revocation request with more than
one
>reason bit set?  Should it somehow prioritize the reasons, and put only the
>"most important reason" into the CRL?  Should it put multiple revocation
entries
>in the CRL, one for each requested reason?  Should it reject the request as
>mal-formed?  Should CMP use CRLReason instead of ReasonFlags?
>
>     Mez
>
>

---

From: Carlisle Adams <[email-masked]>
Date: Thu, 14 Jan 1999 11:08:12 -0500

Hi Mary Ellen,

Having multiple revocation entries in a CRL for a single certificate does
not seem sensible to me.  Furthermore, as I mentioned, I think it is too
late at this stage to get CMP to specify CRLReason instead of ReasonFlags.
Finally, given that there is nothing in the text (of any of the PKIX
documents) telling end entities *not* to set multiple reason bits, it is
hard to justify rejecting such a message as mal-formed.

To me, the most appropriate course of action is to have the CA prioritize
the reasons (according to whatever algorithm it thinks is meaningful) and
put the "most important reason" into the CRL.  This will get us through to
the next iteration of these documents, when we can perhaps specify all this
more tightly.  In practice, however, I can't imagine that this will come up
too often (i.e., I really doubt that EEs will set multiple reason bits
frequently).

Carlisle.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, January 14, 1999 10:53 AM
To: Carlisle Adams
Cc: ietf-pkix
Subject: RE: Reason codes vs Reason flags

Carlisle,

     Mez