Subject: draft-ietf-pkix-rfc3280bis-07.txt

From: "David A. Cooper" <[email-masked]>
Date: Thu, 28 Dec 2006 15:20:00 -0500

All,

Draft -07 of 3280bis is available at 
http://www.ietf.org/internet-drafts/draft-ietf-pkix-rfc3280bis-07.txt.

A diff file highlighting the changes between drafts -06 and -07 is 
available at 
http://csrc.nist.gov/pki/documents/PKIX/draft3280bis-06todraft3280bis-07_diff.html.

Here is a summary of the changes:

1) Text has been added to section 4.1.2.5 (Validity) indicating that CAs 
should use a notAfter of 99991231235959Z in certificates that are not 
intended to expire.  The new text is as follows:

      In some situations, devices are given certificates for which no good
      expiration date can be assigned.  For example, a device could be
      issued a certificate that binds its model and serial number to its
      public key; such a certificate is intended to be used for the entire
      lifetime of the device.

      To indicate that a certificate has no well defined expiration date,
      the notAfter SHOULD be assigned the GeneralizedTime value of
      99991231235959Z.

      When the issuer is not be able to maintain status information until
      the notAfter date (including when the notAfter date is
      99991231235959Z), the issuer MUST ensure that no valid certification
      path exists for the certificate after maintenance of status
      information is terminated.  This may be accomplished by expiration or
      revocation of all CA certificates containing the public key used to
      verify the signature on the certificate and discontinuing use of the
      public key used to verify the signature on the certificate as a trust
      anchor.

2) The text describing the holdInstructionCode CRL entry extension 
(section 5.3.2) was deleted and the ASN.1 associated with the 
holdInstructionCode CRL entry extension was deleted from the ASN.1 
module in appendix A.2.

3) Text was added to section 5.3.1 (Reason Code) and minor modifications 
were made to sections 5.2.4, 6, 6.1.3, and 6.3 to clarify that 
certificates that are listed on a CRL with reason code certificateHold 
are revoked.

Dave