Subject: Re: I-D ACTION:draft-ietf-pkix-rfc3161bis-00.txt

From: Denis Pinkas <[email-masked]>
Date: Thu, 02 May 2002 13:06:15 +0200

Peter,

> The text contains a changement that fixes some text concerning a MUST
> requirement of the TSA policy to be returned, by changing some
> SHOULD to a 'should'.
> 
> I would like to know whether this text corresponds to group
> consensus.
> 
> As far as I remember there are some group members that
> say that the MUST should be a SHOULD.
> 
> I think the conflict can be summarizes with two paragraphs:
> 
> Actual:
> 
>    The policy field MUST indicate the TSA's policy under which the
>    response was produced.  If a similar field was present in the
>    TimeStampReq, then it MUST have the same value, otherwise an error
>    (unacceptedPolicy) MUST be returned.
> 
> Proposed:
> 
>    The 'policy' field MUST indicate the TSA's policy under which the
>    response was produced.  If the field 'reqPolicy' was present in the
>    TimeStampReq, then 'policy' SHOULD have the same value, or an
>    error (unacceptedPolicy) SHOULD be returned.
> 
> Unfortunately it seems difficult to get a common opinion between
> those who specify and those who implement.

Since you posted this message, I have seen no support on the list for your
change proposal, so let us keep the text as it is.

> ------------------------
> 
> I think that the following text
> 
>       " In that case, at any
>        future time, the tokens signed with the corresponding key will be
>        considered as invalid, but tokens generated before the revocation
>        time will remain valid. "

The text you refer to is no longer in the document, because it has been
pointed as erronous by Antoine Bourrouilh on April 4. It has been changed
and the fix has been advertised on the mailing list on April 5 and no one 
has complained with the fix at that time.

Denis  

> should be accompagnied by something like:
> 
>    It is difficult for a user to claim validity of a token that have a date
>    inferior to the revocation date without additional means, e.g.
>    cooperation of the TSA. It is necessary to provide evidence that the
>    time stamp had been created before revocation BY THE TSA.