Subject: Re: [pkix] Revising OCSP - way forward

From: "David A. Cooper" <[email-masked]>
Date: Mon, 28 Jun 2010 18:32:55 -0400

All,

I have created an initial draft of an update to RFC 2560.  It is 
available at http://www.ietf.org/id/draft-cooper-pkix-rfc2560bis-00.txt.

The main goal of this draft was to address confusion about the trust 
models supported by OCSP while avoiding introducing any technical 
changes to the protocol.  In order to facilitate incorporating the 
necessary changes to clarify the trust models, I reorganized the text in 
a way that I hope will improve the readability of the document.  I also 
adding a new Appendix with lots of informative examples (probably too 
many examples).

If this draft makes any technical changes to OCSP, then those were 
errors on my part.  I did, however, incorporate the changes from 
draft-ietf-pkix-ocspagility-08 and I also incorporated two changes from 
RFC 5019, The Lightweight Online Certificate Status Protocol (OCSP) 
Profile for High-Volume Environments.  The changes that were 
incorporated from RFC 5019 are clearly marked and include references to 
the sections in RFC 5019 that were the source of the change.

I plan to be at the next IETF meeting and to give a presentation on this 
draft.

While comments about the details of the draft are welcome, the initial 
question that needs to be answered (on the list and during the PKIX 
session at the next IETF meeting) is whether the working group feels 
that it is appropriate to use this draft as the starting point for 
developing the revision to OCSP.

Thanks,

Dave

On 05/26/2010 04:02 AM, Stefan Santesson wrote:
> All,
>
> Apology for taking time to get back to the list after the show of 
> hands request regarding the future handling of OCSP.
> Steve has been on a few vacation and business trips over the last 2 
> months, and have been slowly catching up with PKIX list traffic.
>
> After looking at the list traffic and discussing the issue we agree 
> that PKIX ought to update OCSP documentation (option 2), e.g., to deal 
> with the various ambiguities that folks have identified and to 
> incorporate the OCSP agility update. As folks noted on the list, we 
> want to keep this effort small, not open one or more cans of worms, so 
> the scope will be very limited.
>
> David Cooper has done a great job on 5280, so we are happy to name him 
>  lead editor.  Stefan, as the lead editor of the agility document, 
> will also contribute, as we would like the update to incorporate that 
> document as well. Other folks who have offered to help are welcome to 
> do so.
>
> In such case, send us and David a note. Otherwise expect a first draft 
> for discussion in a not to distant future.
>
> Steve & Stefan