Subject: [TLS] AD review of draft-ietf-tls-multiple-cert-status-extension

From: Sean Turner <[email-masked]>
Date: Fri, 22 Feb 2013 10:15:13 -0500

Two questions, one comment, and one thing to note:

Q1: Is text needed that restricts the number of requests that can go 
with case ocsp to 1?  e.g.,:

   The list of CertificateStatusRequestItem entries MUST be in
   order of preference. When used with case ocsp, only one request
   item is allowed.  When used with case ocsp_multi, more than one
   request is allowed.

Q2: Should there be an error if case ocsp is used with multiple requests 
or when case ocsp_multi is used with only one request?

C1: CCITT was long ago renamed ITU.  How about we change:
r/[CCITT.X680.2002]/[X680.2002]
r/[CCITT.X690.2002]/[X690.2002]

and use the same references from RFC 5246:

[X680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002,
        Information technology - Abstract Syntax Notation One
        (ASN.1): Specification of basic notation.

[X690] ITU-T Recommendation X.690 (2002) | ISO/IEC 8825-1:2002,
        Information technology - ASN.1 encoding Rules:
        Specification of Basic Encoding Rules (BER), Canonical
        Encoding Rules (CER) and Distinguished Encoding Rules
        (DER).

N1: OCSP is also about to be in last call so the references will likely 
be updated to point to it at some point.

spt