Subject: revoking certificate when confirm verify fails

From: "Kwon, YongChul" <[email-masked]>
Date: Fri, 15 Sep 2000 14:06:55 +0900

There is such sentence in the bottom of section 2.2.2.2 of RFC-2510 and
RFC-2510bis.

(Where verification of the cert confirmation message fails, the RA/CA MUST
revoke the newly issued certificate if it has been published or otherwise
made
available.)

but, above sentence accepts following situation.

CA/RA sent certificate as normal certificate - not encrypted and
CA/RA couldn't receive the confirm message or failed to verify confirm
message.

At this time, CA/RA hasn't published this certificate yet it can be problem.

because client was handed certificate itself already!
and client can use this certificate as if the certificate is correct one.

I don't know "otherwise made available" means this situation.
am I correct?

---

From: Carlisle Adams <[email-masked]>
Date: Fri, 15 Sep 2000 10:08:14 -0400

Hi YongChul,

> ----------
> From: 	Kwon, YongChul[SMTP:[email-masked]]
> Sent: 	Friday, September 15, 2000 1:06 AM
> To: 	PKIX Working Group
> Subject: 	revoking certificate when confirm verify fails
> 
 
Yes, "otherwise made available" includes exactly this situation.  If the
certificate is returned in plaintext, then it is "available" to anyone who
happens to see the message (the requester and any other eavesdroppers on the
line).

Carlisle.