Subject: Re: TSP-09

From: Peter Sylvester <[email-masked]>
Date: Wed, 28 Jun 2000 14:37:27 +0200 (MET DST)

> 
> Modifications to say that a modified Token may be returned when the
> status is one (grantedWithMods), e.g. when some extensions have been
> incorporated in a way that is slightly different from the request.
Note that the status is not part of the token, and it is not signed.
It should be made clear that grantedWithMods can only be seen as a
hint in order to indicate to the client, that the token may not be what
had been asked for.
Anyway, a client has to verify all the fields in the token,
thus this status doesn't really give additional information.   

It is not specified in what situation a TSA would set

         revocationWarning      (4),
          -- this message contains a warning that a revocation is 
          -- imminent 
         revocationNotification (5),
          -- notification that a revocation has occurred 

and 

         addInfoNotAvailable (17)
         -- the additional information requested could not be understood
         -- or is not available

That latter I imagine to see in case of extensions, for example. 

> It is now time to send this document to the IESG. There are still
> opportunities to make minor changes to the document when it becomes
> a Standard, at least six months after it becomes Proposed Standard.
Hm.

The text references a non existing specification:

  A TSA's certificate MAY contain a Subject Information Access (SIA)
  extension [son of RFC2459] in order to convey the method of contacting 
  the TSA.  The accessMethod field in this extension MUST contain the 
  OID id-ad-timestamping:

At least, I propose the following change:  

  A TSA's certificate MAY contain a Subject Information Access (SIA)
  extension [son of RFC2459].  In order to convey the method of contacting 
  the TSA, the accessMethod field in this extension MUST contain the 
  OID id-ad-timestamping:

The following comment should be changed if one uses a SIA:

-- Authority Information Access for TSA

Besides that, I do not think that a SIA is necessary, it is sufficient
to slightly modify the AIA definition by saying that the exact
meaning is defined by the definition of the access method, i.e.,
whether and how it is related to the subject or the issuer.

/P