Subject: RE: WG Last Call Comment for 3280bis

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 8 Dec 2006 03:46:43 -0800

Stefan,

See below.

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]] 
Sent: Friday, December 08, 2006 6:25 AM
To: Santosh Chokhani; Stephen Kent
Cc: pkix
Subject: RE: WG Last Call Comment for 3280bis

To be picky;
We need to be careful not to say that anyone must reject a certificate.
This is still a decision of the RP. There is a difference between the
decision to rely on something for a business reason and to accept the
certificate as valid.

What we should say is that: A certificate on hold MUST be treated as
revoked and MUST fail path validation regardless of any present hold
instruction code.
[Santosh Chokhani] Agree.

What we also might want to say is: A certificate that has been cleared
from on hold status to a non revoked status SHOULD be treated as if it
has never been revoked or on hold. I.e. that the certificate once
cleared is valid for its full validity period.
[Santosh Chokhani] I am not sure on this one.  It depends on the
business model and RP.

Also, what about compliant CRL Issuers?  Should they use hold
instruction extension.  Backward compatibility notwithstanding, I think
not.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of Santosh Chokhani
> Sent: den 7 december 2006 01:19
> To: Stephen Kent
> Cc: pkix
> Subject: RE: WG Last Call Comment for 3280bis
>
>
> Steve,
>
> How about the following:
>
> Compliant producers (i.e., CAs and CRL Issuers) shall not use hold
> instruction.
>
> Compliant consumer (i.e., relying parties) shall reject the
certificate
> regardless of the hold instruction.  Compliant consumers may take
> additional actions as suggested by the hold instruction as long as
> those
> actions are consistent with the rejection of the certificate.
>
> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Wednesday, December 06, 2006 6:34 PM
> To: Santosh Chokhani
> Cc: pkix
> Subject: RE: WG Last Call Comment for 3280bis
>
> At 2:19 PM -0800 12/6/06, Santosh Chokhani wrote:
> >Steve,
> >
> >My apologies for the interruption.
> >
> >We generally use hold and suspension as the same.
> >
> >A practical and simple solution for 3280 Bis is to recommend that
> >regardless of the hold instruction, the certificate that is on hold
as
> >of the time of interest shall be rejected.
> >
>
> Yes, that is the simplest thing to do. The only other question is
> what we say about hold instructions, short of banning them, given
> that we require only that a client treat a cert on hold just like any
> other cert on a CRL.
>
> Steve

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 8 Dec 2006 12:34:41 +0000

Santosh.

What I mean by the second remark, is not what it means from a business model perspective. I was aiming of what it means technically from a path validation perspective. The tricky part is that this is mostly matter for historical validation, and historical validation is out of scope for RFC 3280, and should be.

However, the important point is if a certificate is validated in the present, and it is not revoked, it doesn't matter if that certificate has been on hold in the past, even if the signature validated was signed during a time window when the certificate was on hold.

This seems to be a source of confusion and thus a clarification might be useful.

Stefan Santesson
Senior Program Manager

> From: Santosh Chokhani [mailto:[email-masked]]
> Sent: den 8 december 2006 12:47
> To: Stefan Santesson; Stephen Kent
> Cc: pkix