Subject: RE: Last Call: draft-ietf-pkix-new-part1-06.txt comments

From: Ambarish Malpani <[email-masked]>
Date: Wed, 18 Apr 2001 11:40:33 -0700

I like this.

Part of what I like about this also, is the fact that it doesn't
prevent a non-CA from issuing indirect CRLs. I like the symmetry
between CRL issuance and OCSP response issuance. 

A

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: David P. Kemp [mailto:[email-masked]]
> Sent: Wednesday, April 18, 2001 10:08 AM
> To: [email-masked]
> Subject: Re: Last Call: draft-ietf-pkix-new-part1-06.txt comments
> 
> 
> P.S., my preference is to not use the cA bit to make a distinction
> between types of CRL signers, in which case the text is much simpler:
> 
>       The cRLSign bit MUST be asserted when the subject public key is
>       used for verifying a signature on a CertificateList 
> (e.g., a CRL).
>       
>       If the keyCertSign bit is asserted, then the cA bit in the 
>       basic constraints extension (see 4.2.1.10) MUST be asserted.
>       If the keyCertSign bit is not asserted, then the cA bit
>       in the basic constraints extension MUST NOT be asserted.
> 
> Dave
> 
>

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 18 Apr 2001 12:58:06 -0700

Other than changing "(e.g. CRL)" to "(CRL)" I like this below text better.
It was the "e.g." combined with the text that made me thing of non CRL ways
of doing revocation information.

jim

> From: Ambarish Malpani [mailto:[email-masked]]
> Sent: Wednesday, April 18, 2001 11:41 AM
> To: 'David P. Kemp'; [email-masked]
> Subject: RE: Last Call: draft-ietf-pkix-new-part1-06.txt comments
>
>
>
> I like this.
>