Subject: Re: [pkix] why revoked certificate entry has to be included in one CRL issued beyond certificate validity period

From: "Henry B. Hotz" <[email-masked]>
Date: Tue, 12 Feb 2013 21:49:45 -0800

I understand the argument, but I think that pragmatically it's a distinction without a difference.  Maybe the RP should make the decision, but it needs information from the CA to base the decision on.  That being the case, who's really making the decision?

Also, and I've said this before, if the availability of PKI-protected services are really critical, then no RP would ever cease functioning just because someone was DOSing the source of CRLs.
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

On Jan 8, 2013, at 3:36 PM, Piyush Jain <[email-masked]> wrote:

> The question is - who is in the best position to determine that grace period
> beyond CRL issuance time.
> I would think that it is up to the RP to determine its risk window. 
> 
> CA should not and cannot make that determination for a relying party.
> 
> On the other hand, such a private extension would have given some comfort to
> those RPs who are reluctant to define their own risk tolerance.
> 
> 
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of
>> Kemp, David P.
>> Sent: Tuesday, January 08, 2013 1:34 PM
>> To: pkix
>> Subject: Re: [pkix] why revoked certificate entry has to be included in
> one
>> CRL issued beyond certificate validity period
>> 
>> To be fair, the last time this came up a few years ago PKIX missed the
>> opportunity to define an Internet Private CRL Extension that would allow
> CAs
>> to suggest a grace period beyond which RPs should not consider the CRL
>> fresh.  If a standard useBy date were defined, consumers would have an
>> easier time jawboning RP software vendors to stop treating nextUpdate as
>> an expiration date.
>> 
>> Dave
>> 
>> 
>> 
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of
>> Miller, Timothy J.
>> Sent: Tuesday, January 08, 2013 2:23 PM
>> To: Stephen Kent
>> Cc: pkix
>> Subject: Re: [pkix] why revoked certificate entry has to be included in
> one
>> CRL issued beyond certificate validity period
>> 
>> While I appreciate and would prefer the BOFH approach to deficiency
>> remediation, practically speaking you can't push a rope.  :)  Absent an
>> enforcement regime (e.g., trademark licensing a la VPNC or USB-IF) we're
>> stuck with what we get.
>> 
>> -- T
>> 
>> On 1/8/13 1:12 PM, "Stephen Kent" <[email-masked]> wrote:
>> 
>>> Tim,
>>> 
>>> Your example, and the rationale for it, are just what I worry about.
>>> RP software is written badly, so a CA behaves poorly, to accommodate
>>> the bad RP software. This is just another example of why accmmodating
>>> bad software leads to more bad software ...
>>> 
>>> Steve
>>> 
>>> 
>> 
>> _______________________________________________
>> pkix mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/pkix
>> _______________________________________________
>> pkix mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/pkix
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix