Subject: AW: AW: I-D ACTION:draft-ietf-pkix-new-part1-09.txt

From: Fantou Patrick <[email-masked]>
Date: Fri, 19 Oct 2001 09:02:50 +0200

Russ,

I agree with this replacement text, which is much clearer on OCSP.
But do you not think, that the last paragraph is redundant?
It repeats what you say in the two new paragraphs before and still says 
that RFC2560 defines the access descriptor for OCSP. I would reduce it
to the last sentence : "Additional access descriptors may be defined in
other PKIX specifications."

Patrick

> -----Ursprüngliche Nachricht-----
> Von: Housley, Russ [mailto:[email-masked]]
> Gesendet: Donnerstag, 18. Oktober 2001 15:56
> An: Fantou Patrick
> Cc: [email-masked]
> Betreff: Re: AW: I-D ACTION:draft-ietf-pkix-new-part1-09.txt
> 
> 
> Patrick:
> 
> >2. Clause 4.2.2.1 Authority Information Access says that RFC 
> 2560 defines 
> >the access descriptor for OCSP, but in fact id-ad-ocsp (id-ad 1) is 
> >defined in this draft and RFC 2560 imports it and uses it as 
> base for the 
> >OCSP OID arc.
> 
> Tim Polk and I finally talked.  Here is the proposed replacement text:
> 
>     4.2.2.1  Authority Information Access
> 
>     The authority information access extension indicates how 
> to access CA
>     information and services for the issuer of the 
> certificate in which
>     the extension appears. Information and services may 
> include on-line
>     validation services and CA policy data.  (The location of 
> CRLs is not
>     specified in this extension; that information is provided by the
>     cRLDistributionPoints extension.)  This extension may be 
> included in
>     subject or CA certificates, and it MUST be non-critical.
> 
>     id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
> 
>     AuthorityInfoAccessSyntax  ::=
>             SEQUENCE SIZE (1..MAX) OF AccessDescription
> 
>     AccessDescription  ::=  SEQUENCE {
>             accessMethod          OBJECT IDENTIFIER,
>             accessLocation        GeneralName  }
> 
>     id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
> 
>     id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
> 
>     id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
> 
>     Each entry in the sequence AuthorityInfoAccessSyntax describes the
>     format and location of additional information provided by 
> the CA who
>     issued the certificate in which this extension appears.  
> The type and
>     format of the information is specified by the 
> accessMethod field; the
>     accessLocation field specifies the location of the 
> information.  The
>     retrieval mechanism may be implied by the accessMethod or 
> specified
>     by accessLocation.
> 
>     This profile defines two accessMethod OIDs: 
> id-ad-caIssuers and id-
>     ad-ocsp.
> 
>     The id-ad-caIssuers OID is used when the additional 
> information lists
>     CAs that have issued certificates superior to the CA that 
> issued the
>     certificate containing this extension.  The referenced CA Issuers
>     description is intended to aid certificate users in the 
> selection of
>     a certification path that terminates at a point trusted by the
>     certificate user.
> 
>     When id-ad-caIssuers appears as accessMethod, the accessLocation
>     field describes the referenced description server and the access
>     protocol to obtain the referenced description.  The accessLocation
>     field is defined as a GeneralName, which can take several forms.
>     Where the information is available via http, ftp, or ldap,
>     accessLocation MUST be a uniformResourceIdentifier.  Where the
>     information is available via the Directory Access Protocol (DAP),
>     accessLocation MUST be a directoryName. When the information is
>     available via electronic mail, accessLocation MUST be an 
> rfc822Name.
>     The semantics of other id-ad-caIssuers accessLocation 
> name forms are
>     not defined.
> 
>     The id-ad-ocsp OID is used when revocation information for the
>     certificate containing this extension is available using 
> the Online
>     Certificate Status Protocol (OCSP) [RFC 2560].
> 
>     When id-ad-ocsp appears as accessMethod, the 
> accessLocation field is
>     the location of the OCSP responder, using the conventions 
> defined in
>     [RFC 2560].
> 
>     [RFC 2560] defines the access descriptor for the Online 
> Certificate
>     Status Protocol.  When this access descriptor appears in the
>     authority information access extension, this indicates the issuer
>     provides revocation information for this certificate through the
>     named OCSP service.  Additional access descriptors may be 
> defined in
>     other PKIX specifications.
> 
> Russ
>

---

From: "Housley, Russ" <[email-masked]>
Date: Fri, 19 Oct 2001 09:11:55 -0400

>other PKIX specifications."

Ooops.  We had a small problem with Microsoft Word.  Tim and I were using 
the revisions feature to discuss the proposed text.  When we did a 
cut-and-paste at the end, the strike through (to-be-deleted text) was 
copied too.

Please review the attached text.

Russ

= = = = = = = = = =

    The authority information access extension indicates how to access CA
    information and services for the issuer of the certificate in which
    the extension appears.  Information and services may include on-line
    validation services and CA policy data.  (The location of CRLs is not
    specified in this extension; that information is provided by the
    cRLDistributionPoints extension.)  This extension may be included in
    subject or CA certificates, and it MUST be non-critical.

    Each entry in the sequence AuthorityInfoAccessSyntax describes the
    format and location of additional information provided by the CA that
    issued the certificate in which this extension appears.  The type and
    format of the information is specified by the accessMethod field; the
    accessLocation field specifies the location of the information.  The
    retrieval mechanism may be implied by the accessMethod or specified
    by accessLocation.

    This profile defines two accessMethod OIDs: id-ad-caIssuers and
    id-ad-ocsp.

    The id-ad-caIssuers
    OID is used when the additional information lists CAs that have
    issued certificates superior to the CA that issued the certificate
    containing this extension.  The referenced CA Issuers description is
    intended to aid certificate users in the selection of a certification
    path that terminates at a point trusted by the certificate user.

    available via electronic mail, accessLocation MUST be an rfc822Name.
    The semantics of other id-ad-caIssuers accessLocation name forms are
    not defined.

    The id-ad-ocsp OID is used when revocation information for the
    certificate containing this extension is available using the
    Online Certificate Status Protocol (OCSP) [RFC 2560].

    When id-ad-ocsp appears as accessMethod, the accessLocation
    field is the location of the OCSP responder, using the
    conventions defined in [RFC 2560].

    Additional access descriptors may be defined in
    other PKIX specifications.