Subject: RE: WG Last Call Comment for 3280bis

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 8 Dec 2006 08:52:06 -0800

Carlos,

Can you explain what the difference is between what you say and current time.

Note 3280 Biz statement "Note that mechanisms are not available for validating a
   certificate with respect to a time outside the certificate validity
   period."
 
So, the certificates are not expired and you use current CRL.  To me it seems that is validating as of this time and not some time in the past.

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of Carlos González-Cadenas
Sent: Friday, December 08, 2006 11:37 AM
To: Santosh Chokhani
Cc: Stefan Santesson; Stephen Kent; pkix
Subject: Re: WG Last Call Comment for 3280bis

Santosh,

I don't agree in your affirmation:

>>If you verified a certificate using current CRL, that is like verifying as of this time and not >>as of a time in the past.

Using up-to-date CRL information doesn't imply verifying the certificate status at this time. In fact, the CRL entries contain (past) information about when the revocation of the certificate was produced (so you can use this information to compare with the instant of time you want to validate the certificate in). 

Being the nature of CRL like an "historical accumulative database of revocation events",  for sure you want the most-updated applicable CRL (when saying "applicable" I mean that not all the CRLs issued by a CA contain information for that certificate, potentially only the ones issued before the certificate expiration time). 

The CA is only allowed to remove revocation entries from the "historical accumulative database" (CRL) in the on-hold case, when the certificate is finally determined valid: so, no revocation event, I don't see why would one want to reject the certificate after the on-hold period, when the CA considers there's no revoked certificate (it only makes sense within the on-hold period as a cautionary measure). 

Best regards,

Carlos

On 12/8/06, Santosh Chokhani <[email-masked]> wrote: 

Carlos,

If you verified a certificate using current CRL, that is like verifying as of this time and not as of a time in the past.

Logical definition of a time of interest is to say what the PKI artifacts were at that time and what answer we would have gotten.

The proposed solution also keeps the business model for hold out in the first place.

________________________________

From: [email-masked] [mailto: [email-masked] <mailto:[email-masked]> ] On Behalf Of Carlos González-Cadenas
Sent: Friday, December 08, 2006 11:06 AM
To: Santosh Chokhani
Cc: Stefan Santesson; Stephen Kent; pkix
Subject: Re: WG Last Call Comment for 3280bis

Santosh, Stefan,

I agree with Stefan in both proposals, seeing that the second is of great value, as it clarifies how to proceed for RPs in an area that is certainly difficult and open to interpretation.

I disagree with Santosh in this afirmation: 

>>I would think that Section 6 will give the answer you expect for current
>>time.  In terms of a time in the past, specifically for a time during
>>the hold period, I would think that the user should get CRL applicable 
>>at that time and reject the certificate.

I don't see any reason for not being able to validate in the past a certificate that is within its validity period in the instant of validation, using the latest CRL issued by the CA (no need in this case for archived CRLs). Using Stefan's proposal, if that certificate was removed from hold to valid in the past,  the validation will be successful (no entry in the CRL regarding this cert). 

Note that even when the certificate is expired and CRL archival is needed to validate the certificate, it's not necessary to pick the CRL that included the certificate on-hold. One can get the latest CRL issued before certificate expiration (this makes sense, as it's the most updated one). 

For me this behaviour makes sense, the certificate will be only rejected when it's on-hold and you're validating this certificate in this hold period. When the certificate is removed from hold to valid, no need to consider this certificate revoked in any time in the future (including validations performed after the hold period). 

Best regards,

Carlos

On 12/8/06, Santosh Chokhani < [email-masked] <mailto:[email-masked]> > wrote: 

Stefan,

I agree with your concern, but not your solution.

Section 6.1 of thee 3280 Biz states: 

"The algorithm presented in this section validates the certificate with
respect to the current date and time.  A conforming implementation MAY
also support validation with respect to some point in the past.  Note 
that mechanisms are not available for validating a certificate with
respect to a time outside the certificate validity period."

I would think that Section 6 will give the answer you expect for current
time.  In terms of a time in the past, specifically for a time during
the hold period, I would think that the user should get CRL applicable
at that time and reject the certificate.

BTW, is there a reason you do not answer about CRL Issuer question?  Do 
you compliant Issuers to have option of asserting hold instruction?

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]]
Sent: Friday, December 08, 2006 7:35 AM 
To: Santosh Chokhani; Stephen Kent
Cc: pkix
Subject: RE: WG Last Call Comment for 3280bis

Santosh.

What I mean by the second remark, is not what it means from a business
model perspective. I was aiming of what it means technically from a path 
validation perspective. The tricky part is that this is mostly matter
for historical validation, and historical validation is out of scope for
RFC 3280, and should be.

However, the important point is if a certificate is validated in the 
present, and it is not revoked, it doesn't matter if that certificate
has been on hold in the past, even if the signature validated was signed
during a time window when the certificate was on hold.

This seems to be a source of confusion and thus a clarification might be 
useful.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: Santosh Chokhani [mailto:[email-masked] ]
> Sent: den 8 december 2006 12:47
> To: Stefan Santesson; Stephen Kent
> Cc: pkix
> Subject: RE: WG Last Call Comment for 3280bis
>
> Stefan,
>
> See below.
>
> -----Original Message-----
> From: Stefan Santesson [mailto:[email-masked]]
> Sent: Friday, December 08, 2006 6:25 AM
> To: Santosh Chokhani; Stephen Kent 
> Cc: pkix
> Subject: RE: WG Last Call Comment for 3280bis
>
> To be picky;
> We need to be careful not to say that anyone must reject a
certificate.
> This is still a decision of the RP. There is a difference between the 
> decision to rely on something for a business reason and to accept the
> certificate as valid.
>
> What we should say is that: A certificate on hold MUST be treated as
> revoked and MUST fail path validation regardless of any present hold 
> instruction code.
> [Santosh Chokhani] Agree.
>
> What we also might want to say is: A certificate that has been cleared
> from on hold status to a non revoked status SHOULD be treated as if it 
> has never been revoked or on hold. I.e. that the certificate once
> cleared is valid for its full validity period.
> [Santosh Chokhani] I am not sure on this one.  It depends on the
> business model and RP. 
>
> Also, what about compliant CRL Issuers?  Should they use hold
> instruction extension.  Backward compatibility notwithstanding, I
think
> not.
>
>
> Stefan Santesson
> Senior Program Manager 
> Windows Security, Standards
>
> > -----Original Message-----
> > From: [email-masked] [mailto:owner-ietf- 
> > [email-masked]] On Behalf Of Santosh Chokhani
> > Sent: den 7 december 2006 01:19
> > To: Stephen Kent
> > Cc: pkix
> > Subject: RE: WG Last Call Comment for 3280bis 
> >
> >
> > Steve,
> >
> > How about the following:
> >
> > Compliant producers (i.e., CAs and CRL Issuers) shall not use hold
> > instruction.
> > 
> > Compliant consumer (i.e., relying parties) shall reject the
> certificate
> > regardless of the hold instruction.  Compliant consumers may take
> > additional actions as suggested by the hold instruction as long as 
> > those
> > actions are consistent with the rejection of the certificate.
> >
> > -----Original Message-----
> > From: Stephen Kent [mailto:[email-masked] ]
> > Sent: Wednesday, December 06, 2006 6:34 PM
> > To: Santosh Chokhani
> > Cc: pkix
> > Subject: RE: WG Last Call Comment for 3280bis
> >
> > At 2:19 PM -0800 12/6/06, Santosh Chokhani wrote: 
> > >Steve,
> > >
> > >My apologies for the interruption.
> > >
> > >We generally use hold and suspension as the same.
> > >
> > >A practical and simple solution for 3280 Bis is to recommend that 
> > >regardless of the hold instruction, the certificate that is on hold
> as
> > >of the time of interest shall be rejected.
> > >
> >
> > Yes, that is the simplest thing to do. The only other question is 
> > what we say about hold instructions, short of banning them, given
> > that we require only that a client treat a cert on hold just like
any
> > other cert on a CRL.
> > Steve

---

From: "Carlos González-Cadenas" <[email-masked]>
Date: Fri, 8 Dec 2006 19:37:48 +0100

Santosh,

Of course. I'll try to be more precise. Sorry for the inconvenience.

Let's assume:

VT = the instant of time in which a RP performs the validation of a
certificate (i.e. when you use your cert path validation software / you
press the validate button, ...).
T = the instant of time in which we want to know if the certificate is/was
valid or not (i.e. obtained via a timestamp in a signature). This is the
instant that gets checked against the revocation date of the CRL.
NB = Not Before
NA = Not After
HS = Hold Period Start
HE = Hold Period End
CRL = CRL ThisUpdate

The default (and most common case) is VT=T (the RP doesn't provide T).
That's validating the certificate at the actual moment (VT) and in the
actual moment (T) (i.e. we're interested now in the actual certificate
status).

Validating in a time in the past implies T<VT (we request to validate
certificate in T at a later instant VT). For that we can have two possible
temporal sequences of interest:

1) NB<HS<T<HE<CRL<NA<VT, we want to know the certificate status in T AFTER
the end of the certificate validity period, here we need CRL archival (CRLs
issued after NA doesn't contain any info about the certificate), and, as you
said, this is not covered by 3280/3280bis.

2) NB<HS<T<HE<CRL<VT<NA, so we want to know at VT (before the end of
validity of the certificate) the status of the certificate in T. This case
(if I'm not wrong) is covered by 3280/3280bis and does not require archival
of CRLs, as we can use the CRL issued at the CRL instant depicted above. The
CRL will not contain any revocation entry (as it's issued after HE), and
therefore the certificate will be considered valid (and in my opinion that's
correct).

That 2) is in sync with Stefan's proposal:
> A certificate that has been cleared

Regards,

Carlos

On 12/8/06, Santosh Chokhani <[email-masked]> wrote:
>  ------------------------------
>
> *From:* [email-masked] [mailto:
> [email-masked]] *On Behalf Of *Carlos González-Cadenas
> *Sent:* Friday, December 08, 2006 11:37 AM
> *To:* Santosh Chokhani
> *Cc:* Stefan Santesson; Stephen Kent; pkix
> *Subject:* Re: WG Last Call Comment for 3280bis
>
>
>
> Santosh,
>
> >>If you verified a certificate using current CRL, that is like verifying
> as of this time and not >>as of a time in the past.
>
> Using up-to-date CRL information doesn't imply verifying the certificate
> status at this time. In fact, the CRL entries contain (past) information
> about when the revocation of the certificate was produced (so you can use
> this information to compare with the instant of time you want to validate
> the certificate in).
>
> Being the nature of CRL like an "historical accumulative database of
> revocation events",  for sure you want the most-updated applicable CRL (when
> saying "applicable" I mean that not all the CRLs issued by a CA contain
> information for that certificate, potentially only the ones issued before
> the certificate expiration time).
>
> The CA is only allowed to remove revocation entries from the "historical
> accumulative database" (CRL) in the on-hold case, when the certificate is
> finally determined valid: so, no revocation event, I don't see why would one
> want to reject the certificate after the on-hold period, when the CA
> considers there's no revoked certificate (it only makes sense within the
> on-hold period as a cautionary measure).
>
> Best regards,
>
> Carlos
>
>
> On 12/8/06, *Santosh Chokhani* <[email-masked]> wrote:
>
> Carlos,
>
>
>
> If you verified a certificate using current CRL, that is like verifying as
> of this time and not as of a time in the past.
>
>
>
> Logical definition of a time of interest is to say what the PKI artifacts
> were at that time and what answer we would have gotten.
>
>
>
>  ------------------------------
>
> *From:* [email-masked] [mailto:[email-masked]]
> *On Behalf Of *Carlos González-Cadenas
> *Sent:* Friday, December 08, 2006 11:06 AM
> *To:* Santosh Chokhani
> *Cc:* Stefan Santesson; Stephen Kent; pkix
> *Subject:* Re: WG Last Call Comment for 3280bis
>
>
>
> Santosh, Stefan,
>
> I agree with Stefan in both proposals, seeing that the second is of great
> value, as it clarifies how to proceed for RPs in an area that is certainly
> difficult and open to interpretation.
>
> I don't see any reason for not being able to validate in the past a
> certificate that is within its validity period in the instant of validation,
> using the latest CRL issued by the CA (no need in this case for archived
> CRLs). Using Stefan's proposal, if that certificate was removed from hold to
> valid in the past,  the validation will be successful (no entry in the CRL
> regarding this cert).
>
> Note that even when the certificate is expired and CRL archival is needed
> to validate the certificate, it's not necessary to pick the CRL that
> included the certificate on-hold. One can get the latest CRL issued before
> certificate expiration (this makes sense, as it's the most updated one).
>
> For me this behaviour makes sense, the certificate will be only rejected
> when it's on-hold and you're validating this certificate in this hold
> period. When the certificate is removed from hold to valid, no need to
> consider this certificate revoked in any time in the future (including
> validations performed after the hold period).
>
> Best regards,
>
> Carlos
>
> On 12/8/06, *Santosh Chokhani* < [email-masked]> wrote:
>
>
> Stefan,
>

---

From: "David A. Cooper" <[email-masked]>
Date: Fri, 08 Dec 2006 13:57:32 -0500

Santosh,

I think the answer is that before you can determine what CRL to use
when validating a certification path as of some time in the past, one
must first determine what one is trying to determine.

If you are trying to determine whether a relying party that validated a
certification path at time t would have determined that the
path was valid, then it may be necessary to use a CRL that was current
at time t.  If you are trying to determine whether the
certification path should have been considered valid at time t,
using current CRLs (assuming none of the certificates in the path have
expired) would be better.  For example, a CRL issued before time t,
but with a nextUpdate time after t, not may list the target
certificate are revoked.  However, the current CRL may list the target
certificate as revoked with an invalidityDate that precedes t:

Invalidity date is the date/time at which it is known or
suspected that the private key was compromised or that the certificate
should otherwise be considered invalid. This date may be earlier that
the revocation date. In the CRL, invalidity date is the value contained
in the invalidityDate entry extension.

In this case, a relying party validating the certificate at time t
would have considered the certificate to be valid.  However, a relying
party validating the certificate using a current CRL will be informed
that the certificate should not have been considered valid at time t.
If I were trying to determine whether to accept the signature on a
document that was signed at time t, I would use the current CRL
and thus determine that the signature should not be considered valid.
If I were trying to determine whether someone who validated the
signature at time t was justified in accepting the signature,
I would determine that they were justified since the CRL that was
available at the time did not indicate that the certificate was revoked.

Of course, the ability to place a certificate on hold adds another
complication since this opens up the possibility that a current CRL
indicates that a certificate is not revoked even though an earlier CRL
indicated that it was on hold.  But the principal is the same.  Do you
want to know what response a relying party validating the certificate
at time t would have gotten or do you want to factor in
information that has been made available since time t in
determining whether a certificate was valid at time t . (From
my point of view, if a certificate was on hold at time t and
then later removed from hold, one can consider that the certificate was
valid at time t even though relying parties that attempted to
validate the certificate at time t would not have considered
the certificate to be valid).

Dave

Santosh Chokhani wrote:

Carlos,

Can you
explain what the difference is
between what you say and current time.

Note 3280 Biz statement “Note that mechanisms are not available for validating a

period.”

From:
[email-masked]
[mailto:[email-masked]] On Behalf Of Carlos
González-Cadenas

Sent: Friday, December
08, 2006
11:37 AM

To: Santosh Chokhani

Cc: Stefan Santesson;
Stephen
Kent; pkix

Subject: Re: WG Last
Call Comment
for 3280bis

Santosh,

I don't agree in your affirmation:

>>If
you verified a certificate using
current CRL, that is like verifying as of this time and not >>as
of a
time in the past.

Using up-to-date CRL information doesn't imply verifying the
certificate status
at this time. In fact, the CRL entries contain (past) information about
when
the revocation of the certificate was produced (so you can use this
information
to compare with the instant of time you want to validate the
certificate in).

Being the nature of CRL like an "historical accumulative database of
revocation events",  for sure you want the most-updated applicable
CRL (when saying "applicable" I mean that not all the CRLs issued by
a CA contain information for that certificate, potentially only the
ones issued
before the certificate expiration time).

The CA is only allowed to remove revocation entries from the
"historical
accumulative database" (CRL) in the on-hold case, when the certificate
is
finally determined valid: so, no revocation event, I don't see why
would one
want to reject the certificate after the on-hold period, when the CA
considers
there's no revoked certificate (it only makes sense within the on-hold
period as
a cautionary measure).

Best regards,

Carlos

On
12/8/06, Santosh
Chokhani <[email-masked]>
wrote:

Carlos,

If you
verified a certificate using current CRL, that is like
verifying as of this time and not as of a time in the past.

Logical
definition of a time of interest is to say what the
PKI artifacts were at that time and what answer we would have gotten.

The proposed
solution also keeps the business model for hold
out in the first place.

From: [email-masked]
[mailto:
[email-masked]] On
Behalf Of Carlos González-Cadenas

Sent: Friday, December
08, 2006
11:06 AM

To: Santosh Chokhani

Cc: Stefan Santesson;
Stephen
Kent; pkix

Subject: Re: WG Last
Call Comment
for 3280bis

Santosh, Stefan,

I agree with Stefan in both proposals, seeing that the second is of
great
value, as it clarifies how to proceed for RPs in an area that is
certainly
difficult and open to interpretation.

I disagree with Santosh in this afirmation:

>>I would think that Section 6 will give the answer you expect
for
current

I don't see any reason for not being able to validate in the past a
certificate
that is within its validity period in the instant of validation, using
the
latest CRL issued by the CA (no need in this case for archived CRLs).
Using
Stefan's proposal, if that certificate was removed from hold to valid
in the
past,  the validation will be successful (no entry in the CRL regarding
this cert).

Note that even when the certificate is expired and CRL archival is
needed to
validate the certificate, it's not necessary to pick the CRL that
included the
certificate on-hold. One can get the latest CRL issued before
certificate
expiration (this makes sense, as it's the most updated one).

For me this behaviour makes sense, the certificate will be only
rejected when
it's on-hold and you're validating this certificate in this hold
period. When
the certificate is removed from hold to valid, no need to consider this
certificate revoked in any time in the future (including validations
performed
after the hold period).

Best regards,

Carlos

On
12/8/06, Santosh
Chokhani <
[email-masked]> wrote:

Stefan,

respect to the current date and time.  A conforming implementation
MAY

BTW, is there a reason you do not answer about CRL Issuer
question?  Do

-----Original Message-----

To: Santosh Chokhani;
Stephen Kent

Cc: pkix

Santosh.

model perspective. I was aiming of what it means technically from a
path

RFC 3280, and should be.

This seems to be a source of confusion and thus a clarification might
be

useful.

Stefan Santesson

Senior Program Manager

> From: Santosh Chokhani
[mailto:[email-masked]
]

> To: Santosh Chokhani;
Stephen
Kent

certificate.

> [Santosh Chokhani]
Agree.

> [Santosh Chokhani] I am
not
sure on this one.  It depends on the

think

> > At 2:19 PM -0800 12/6/06, Santosh
Chokhani

> > >regardless of the hold instruction, the certificate that
is on
hold

any

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 8 Dec 2006 16:32:25 -0500

David,

One of the principles from freshman physics is that data is never
removed from an engineering notebook.  Errors can be annotated with
corrections, explained as expected measurement error, or left
unexplained, but measurements are never erased.

It is fine to ask what the best answer is today given all available
information, but as long as it is also possible to ask what response a
relying party would have gotten at time t (or more to the point,
actually did get at time t, in order to judge whether the RP acted
appropriately based on the information available to him), then erasing
conflicting information (removing an entry from a CRL) rather than
preserving the fact that an entry was added at time x and rescinded at
time y is insufficient.

Dave

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of David A. Cooper

... But the principal is the same.  Do you want to know what response a
relying party validating the certificate at time t would have gotten or
do you want to factor in information that has been made available since
time t in determining whether a certificate was valid at time t .