Subject: RE: draft-ietf-pkix-lightweight-ocsp-profile and RFC 2560

From: "Santosh Chokhani" <[email-masked]>
Date: Sun, 12 Nov 2006 08:51:15 -0800

Mike,

If 2560 is revised, the following items should also be considered.

1.  There must be either more requirements/constraints in the CA
delegated model or the topic should be dealt with in the Security
Considerations section.  See our paper in 2006 NIST PKI Research
conference proceedings.  Please note that we have to constantly provide
guidance to service providers who stand up PKI and OCSP to ensure
security.

2.  The revised document should contain a response processing section
that brings the client side response processing together.

3.  Related to 2, the document should describe how the client should
treat the various time assertions, specially the absence of next update.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Michael Myers
Sent: Saturday, November 11, 2006 4:37 PM
To: Russ Housley; Dave Engberg
Cc: [email-masked]; Sam Hartman
Subject: RE: draft-ietf-pkix-lightweight-ocsp-profile and RFC 2560

Russ,

Thanks for the explanation.  I will coordinate with Steve and Stephan.
Perhaps we can also take care of that pesky hash algorithm agility issue
at
the same time.

Mike

-----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Friday, November 10, 2006 7:53 PM
>
> . . .
>
> The only way forward that I see is RFC 2560bis.

Russ

---

From: "Michael Myers" <[email-masked]>
Date: Sun, 12 Nov 2006 14:27:59 -0800

Santosh,

I prefer to just clarify this error case.

Mike