Subject: [TSP] PKIStatus constants clarification

From: tho <[email-masked]>
Date: Wed, 18 Dec 2002 13:53:31 +0100

I could not understand the PKIStatus constants semantics aside 
from granted(0) and waiting(3) - that I imagine as a polite way 
by which a busy server notifies a client when the processing of 
the TimeStampReq is impossible due to temporary overload...

Could someone give me some hints on how to interpret the following 
codes: 

- grantedWithMods(1) 
  To which modifications does this refers to ? 
  And moreover, which kind of modifications could a TSA inject 
  into a TimeStampResp ?  If not stated, it seems to me just 
  confusing.

- revocationWarning(4) 
  The text says - pasting from rfc2510 -: "this message contains
  a warning that a revocation is imminent.". 
  Well, but revocation of what ?

- revocationNotification(5)
  Again, revocation of what ? Seemingly this could refer to the 
  signing certificate, but how can I tell which certificate is 
  since there is no means to identify it ?

Thomas

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 18 Dec 2002 17:00:20 +0100

Thomas,

>   into a TimeStampResp ?  If not stated, it seems to me just 

The extension field my include a request for additional information. The 
extension may be recognized but the additional data that is requested may 
not be available. The token is nevertheless provided.

>   Well, but revocation of what ?

of the TSU certificate.

>   Again, revocation of what ? 

of the TSU certificate.

>   Seemingly this could refer to the 

    Extract from RFC 3161: " The certificate identifier (ESSCertID) of the
    TSA certificate MUST be included as a signerInfo attribute inside a
    SigningCertificate attribute."

Denis

---

From: tho <[email-masked]>
Date: Wed, 18 Dec 2002 17:12:28 +0100

Denis,

>     SigningCertificate attribute."

rfc3161 says:

  "When the status contains the value zero or one, a TimeStampToken MUST
   be present.  When status contains a value other than zero or one, a
   TimeStampToken MUST NOT be present."

so in case of rejection(2), waiting(3), revocationWarning(4) and
revocationNotification(5) the client has no ESSCertID back...

Thomas

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 19 Dec 2002 09:03:39 +0100

Thomas,

Michael Aisenberg asked us to go off-line. Well, PKIX is an open discussion 
list. If a change has to be done on a document, it has to be openly discussed.

Now, having said this, Thomas, if my response below on that topic,
i.e. PKIStatus constants clarification, does not satisfy you,
please go off-line and copy my co-editors.

> revocationNotification(5) the client has no ESSCertID back...

So what ? It says that the TSU certificate, whatever it is, is either going 
to be revoked or has been revoked.

Denis