Subject: R: on-hold certificates in CRLs

From: "Santoni Adriano" <[email-masked]>
Date: Mon, 4 Dec 2006 11:46:27 +0100

>> I have come across two real world examples of it being used in national ID schemes. 

I confirm that. More precisely, the Italian legislation makes it mandatory for a qualified CA to support certificate suspension. 

And since managing a CRL is also mandatory, there is no other way to achieve suspension than using the "certificateHold" reason code in the CRL.

We do not see any particular problem about that.

Our national legislation also mandates the archival of all certificate life-cycle events, so all CRLs must be archived. Therefore, the certificate history is preserved.

Adriano

-----Messaggio originale-----
Da: [email-masked] [mailto:[email-masked]] Per conto di Dr Stephen Henson
Inviato: lunedì 27 novembre 2006 21.10
A: [email-masked]
Oggetto: Re: on-hold certificates in CRLs

Russ Housley wrote:
> 
> I would like to take this opportunity to advocate the deprecation of 
> "on hold" altogether.  No good can come from it, as been discussed so 
> many times on this list.
> 
> I can live with the current text, but I think it would be far better 
> to say that the "on hold" status MUST NOT be used by CAs conforming to 
> 3280bis.
> 

I have come across two real world examples of it being used in national ID schemes. In both of these a certificate is automatically placed "on hold" when the card is manufactured and then made valid when the recipient has performed some procedure to acknowledge receipt. I suspect that the two I saw are far from isolated examples.

Personally the use of "on hold" always makes me rather uneasy and I'd have no objections about it being deprecated.

Steve.
--
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.

*******************Internet Email Confidentiality Footer*******************

Qualsiasi utilizzo non autorizzato del presente messaggio nonché dei suoi allegati è vietato e potrebbe costituire reato. Se ha ricevuto per errore il presente messaggio, Le saremmo grati se ci inviasse, via e-mail, una comunicazione al riguardo e provvedesse nel contempo alla distruzione del messaggio stesso e dei suoi eventuali allegati.
Le dichiarazioni contenute nel presente messaggio nonche' nei suoi eventuali allegati devono essere attribuite esclusivamente al mittente e non possono essere considerate come trasmesse o autorizzate da ACTALIS S.p.A.; le medesime dichiarazioni non impegnano ACTALIS S.p.A. nei confronti del destinatario o di terzi. 
ACTALIS S.p.A. non si assume alcuna responsabilita' per eventuali intercettazioni, modifiche o danneggiamenti del presente messaggio e-mail. 

Any unauthorized use of this e-mail or any of its attachments is prohibited and could constitute an offence. If you are not the intended addressee please advise immediately the sender by using the reply facility in your e-mail software and destroy the message and its attachments. The statements and opinions expressed in this e-mail message are those of the author of the message and do not necessarily represent those of ACTALIS S.p.A. Besides, The contents of this message shall be understood as neither given nor endorsed by ACTALIS S.p.A.. 
ACTALIS S.p.A. does not accept liability for corruption, interception or amendment, if any, or the consequences thereof.

---

From: Dr Stephen Henson <[email-masked]>
Date: Mon, 04 Dec 2006 12:26:36 +0000

Santoni Adriano wrote:
> I confirm that. More precisely, the Italian legislation makes it
> mandatory for a qualified CA to support certificate suspension.
> 
> And since managing a CRL is also mandatory, there is no other way to
> achieve suspension than using the "certificateHold" reason code in
> the CRL.
> 
> Our national legislation also mandates the archival of all
> certificate life-cycle events, so all CRLs must be archived.
> Therefore, the certificate history is preserved.
> 

How does the legislation treat a signature made during the hold period
when the certificate is valid at some later time?

Steve.

---

From: "Santoni Adriano" <[email-masked]>
Date: Mon, 4 Dec 2006 15:09:40 +0100

>> How does the legislation treat a signature made during the hold period when the certificate is valid at some later time?

There is no explicit provision for that.

Adriano

-----Messaggio originale-----
Da: [email-masked] [mailto:[email-masked]] Per conto di Dr Stephen Henson
Inviato: lunedì 4 dicembre 2006 13.27
A: [email-masked]
Oggetto: Re: R: on-hold certificates in CRLs

Santoni Adriano wrote:
> achieve suspension than using the "certificateHold" reason code in the 
> CRL.
> 
> Our national legislation also mandates the archival of all certificate 
> life-cycle events, so all CRLs must be archived.

How does the legislation treat a signature made during the hold period when the certificate is valid at some later time?

Steve.

---

From: Alfredo Esposito <[email-masked]>
Date: Mon, 04 Dec 2006 16:13:27 +0100

Good question

The signature is invalid. This is why the Italian CSP SHALL store all
the CRLs.

At the moment the verification at some time in the past is not
standardized in Italy and any CSP developed its own solution but there
are documents from ETSI  defining how to embed  the verification and
validation data in the PKCS#7 (or XML) envelope

Dino Esposito

Dr Stephen Henson wrote:

Santoni Adriano wrote:

I have come across two real world examples of it being used in
national ID schemes.

Steve.