Subject: Re: roadmap

From: [email-masked] (Peter Gutmann)
Date: Wed, 24 Apr 2002 15:32:57 +1200 (NZST)

Peter Sylvester <[email-masked]> writes:

>Thus, it is not just a question of whether OCSP v2 being alive or not.

Can I also add a general complaint about the vague status of OCSPv2, there's
already software deployed which uses the extended range of cert IDs in the v2
draft, which makes it annoying to have it fading in and out of consciousness
every few months.  Perhaps the new cert IDs (which are a trivial change) could
be moved into 2560-bis, without requiring all the extra stuff which was added
in the rest of the v2 draft.

Peter.

---

From: "Michael Myers" <[email-masked]>
Date: Wed, 24 Apr 2002 09:10:12 -0700

Peter,

v2's status mostly tracks that of the DPV and DPD requirements,
which have only recently settled down after about a year's worth
of effort.  As I said before, it didn't make much sense to track
that moving target with incremental I-Ds.  I once had three
separate I-Ds but that got so hard to manage and work due to
syntatic and editorial overlap (not to mention review) that I
put them all in one.  I prefer to keep that structure together
while we see how things shake out re: DPV/DPD.  Since 2560bis is
pretty well on its way, I think we should let that go forward
cleanly rather than force a reset due to adding new syntax.

Mike

Michael Myers
t: +415.819.1362
e: mailto:[email-masked]
w: http://www.traceroutesecurity.com

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of
> Peter Gutmann
> Sent: Tuesday, April 23, 2002 8:33 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: roadmap
>
>
>

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 25 Apr 2002 15:14:17 +0200

Michael,

> of effort.  

OCSP *cannot* be the right vector to support DPV requirements since the role
of a CA is different from the role of a DPV server: a CA is only responsible
for the certificates that it has issued. A DPV server can be any entity
provided that it supports the appropriate validation policy which is *not*
established by a CA. As another argument: having at the same time in the
same response both a *single* OSCP response and a DPV response would be
quite odd. The DPV response provides information which would make the
*single* OCSP response useless. However the DPV response may include
*several* OCSP responses *and* the full certification path, if requested by
the client.

So my request is the same as made on the mailing list: RFC250bis should only
be updated to allow to specify a certificate using additional ways. OCSPv2
should be discontinued or at least the name "OCSPv2" dropped. This does not
mean that some ideas from that protocol cannot be re-used to fit with the
DPV requirements.

However, this discussion is not directly related to the roadmap. ;-)

Denis

> As I said before, it didn't make much sense to track

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 25 Apr 2002 09:10:25 -0700

Denis,

I agree with Ambarish.  This is a reset to interop testing we
don't want to incur.

Mike

> [mailto:[email-masked]]On Behalf Of Denis Pinkas
> Sent: Thursday, April 25, 2002 6:14 AM
>
> . . .
>
> So my request is the same as made on the mailing
> list: RFC250bis should only  be updated to allow
> to specify a certificate using additional ways.