Subject: RE: OCSP and CSL

From: "Grant, Alistair" <[email-masked]>
Date: Thu, 27 Jan 2000 22:43:46 +1100

Massimiliano Pala wrote:
> The CSLs, let's call them CSL to distinguish from CRLs, have 
> sense in env
> where there is a time gap between the 'request for cert 
> revoking' by the
> user and the effective revoking by the CA: this is obvious if 
> you consider
> structures where the main CA computer is disconnected from 
> any network.
> 
> Would you allow a certificate to be used when a user says it 
> could have
> been compromised ? You can not either say it is revoked 
> because it is not
> (CRLs do not report it) and there is no way to verify it till the new
> CRL is issued.
> 
> With some instrument like the proposed CSLs (that is only a 
> proposal, I am
> not saying it is the best or the only solution to the 
> problem, I am obviously
> open to EVERY comment... :-D and hopefully to some better 
> solutions) you can
> say, from the moment the user signals a danger the usage of 
> the certificate
> is compromised and that itself is to be considered in a 
> 'freezed' state.
> 
> Am I completely out of the target ? What do you think about 
> this problem ?
> Thanks for the comments you sent.

Unless I am misunderstanding your proposal, I would have thought that CSL's
would suffer the same problems as CRL's if the CA is off-line (disconnected
from the network).

In any case, this sounds like you are looking for (near) real-time
revocation.  In that case, you might like to consider using an on-line
protocol such as OCSP (RFC2560).  OCSP returns a status of 'good', 'revoked'
or 'unknown'.  In the case of 'revoked', there is a revocation reason and
time.  As has already been pointed out by Tom Gindin, one of the reasons is
certificateHold, i.e. suspended.  OCSP Responders may determine the status
of the certificate in a number of ways, e.g. CRL or status lookup in a
directory.

Hope this helps.

Cheers,

Alistair Grant
Computer Associates International.
Phone:    +61 3 9727 8912
Mobile:   +61 408 565 080
Fax:      +61 3 9727 3491
E-Mail:   [email-masked]

---

From: Massimiliano Pala <[email-masked]>
Date: Thu, 27 Jan 2000 13:07:50 +0100

Ok, so, as far as I can understand the final proposed solution would be to
use the the OCSP server to send responses with extentions on the reason
(certificateHold).

I do think that the 'suspended' state could be bettere handled and some few
lines could be spent on the drafts (OCSP ???).

I'll follow your advice. Thank you all for the replies.

C'you,

	Massimiliano Pala ([email-masked])

P.S.: If you have more ideas on this, please send me two lines... :-D