Subject: RE: WG Last Call Comment for 3280bis

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 6 Dec 2006 14:19:14 -0800

Steve,

My apologies for the interruption.

We generally use hold and suspension as the same.

A practical and simple solution for 3280 Bis is to recommend that
regardless of the hold instruction, the certificate that is on hold as
of the time of interest shall be rejected.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Kent
Sent: Wednesday, December 06, 2006 1:05 PM
To: David A. Cooper
Cc: Russ Housley; pkix
Subject: Re: WG Last Call Comment for 3280bis

At 9:58 AM -0500 12/1/06, David A. Cooper wrote:
>Steve,
>
>I don't understand your claim that support for the full range of 
>hold instruction codes imposes a significant burden on relying 
>parties.
>
>Given the text that is in RFC 3280, could you please explain how a 
>relying party that can process the holdInstruction extension might 
>be expected to respond differently to the following three scenarios 
>(In each scenario, the certificate is listed on the CRL with a 
>reasonCode extension that specifies certificateHold):
>
>     * Scenario 1:  holdInstruction extension is not present

If there is no hold instruction, a software developer has no idea 
what to do with the cert in an automated fashion. The fact that 3280 
says he MAY reject it is not definitive.

>     * Scenario 2: holdInstruction extension is present and specifies 
>id-holdinstruction-none

just as useful as scenario 1, but has the advantage of wasting 
additional bits in the CRL :-) that convey no extra meaning.

>     * Scenario 3: holdInstruction extension is present and specifies 
>id-holdinstruction-reject

This is a clear instruction; it says "treat this just like any 
revoked cert, for now."

I am confused by your comments re suspension. When I look at 3280, I 
see NO reason code called "suspension."  In fact, the words "suspend" 
or "suspension" appear nowhere in 3280. So, on what basis should RPs 
figure put that the reason code is used to effect suspension?

In looking at other PKIX RFCs, the term "suspension" appears only in 
our informational documents on CP/CPS.  Those document never specify 
how to achieve suspension, not are they standards track document.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 6 Dec 2006 18:34:28 -0500

>of the time of interest shall be rejected.

Yes, that is the simplest thing to do. The only other question is 
what we say about hold instructions, short of banning them, given 
that we require only that a client treat a cert on hold just like any 
other cert on a CRL.

Steve