Subject: RE: WG Last Call Comment for 3280bis

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 12 Dec 2006 13:56:17 -0800

Stefan

How about the following replacement for the last sentence:

"Conforming applications that encounter this extension MUST reject the
certificate.   Conforming applications MAY also take actions based on
the hold instruction as long as those actions are consistent with the
rejection of the certificate."

We should require that the certificate be rejected.  The second sentence
about following through on the hold instruction is optional.  Your
proposed text leaves the acceptance to the relying party.  I thought we
had a consensus that the certificate on hold must be rejected like any
other certificate on CRL. 

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stefan Santesson
Sent: Tuesday, December 12, 2006 10:27 AM
To: pkix
Cc: Russ Housley
Subject: RE: WG Last Call Comment for 3280bis

Regarding Russ proposed text I suggest the following change based on our
discussion:

OLD TEXT:

5.3.2  Hold Instruction Code

   The hold instruction code is a non-critical CRL entry extension that

   provides a registered instruction identifier, which indicates the

   action to be taken after encountering a certificate that has been

   placed on hold.

   id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }

   HoldInstructionCode ::= OBJECT IDENTIFIER

   The following instruction codes have been defined.  Conforming

   applications that process this extension MUST recognize the following

   instruction codes.

   holdInstruction    OBJECT IDENTIFIER ::=

                    { iso(1) member-body(2) us(840) x9-57(10040) 2 }

   id-holdinstruction-none   OBJECT IDENTIFIER ::= {holdInstruction 1}

   id-holdinstruction-callissuer

                             OBJECT IDENTIFIER ::= {holdInstruction 2}

   id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}

PROPOSED REPLACEMENT TEXT:

5.3.2  Hold Instruction Code

   The hold instruction code is a non-critical CRL entry extension that

   provides a registered instruction identifier, which indicates the

   action to be taken after encountering a certificate that has been

   placed on hold.

   id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }

   HoldInstructionCode ::= OBJECT IDENTIFIER

   Any use of this extension is outside the scope of this specification.

   Conforming CAs MUST NOT include this extension in CRLs. Conforming

   applications that encounter this extension SHOULD ignore it and 

   reject the certificate.

 

Stefan Santesson

Senior Program Manager

Windows Security, Standards

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 13 Dec 2006 14:39:17 +0000

Santosh

I'm fine with your proposal.

Stefan Santesson
Senior Program Manager

From: [email-masked] [mailto:[email-masked]] On Behalf Of Santosh Chokhani
Sent: den 12 december 2006 22:56
To: pkix
Subject: RE: WG Last Call Comment for 3280bis

Stefan

"Conforming applications that encounter this extension MUST reject the certificate.   Conforming applications MAY also take actions based on the hold instruction as long as those actions are consistent with the rejection of the certificate."

We should require that the certificate be rejected.  The second sentence about following through on the hold instruction is optional.  Your proposed text leaves the acceptance to the relying party.  I thought we had a consensus that the certificate on hold must be rejected like any other certificate on CRL.

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stefan Santesson
Sent: Tuesday, December 12, 2006 10:27 AM
To: pkix
Cc: Russ Housley
Subject: RE: WG Last Call Comment for 3280bis

Regarding Russ proposed text I suggest the following change based on our discussion:

OLD TEXT:

   placed on hold.

   instruction codes.

   placed on hold.

   reject the certificate.

Stefan Santesson
Senior Program Manager