Subject: Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

From: Peter Gutmann <[email-masked]>
Date: Thu, 1 Nov 2012 00:00:58 +0000

Martin Rex <[email-masked]> writes:

>I don't think silver bullets exist (I wrote that previously), but one can
>hardly do worse that rfc2560 for online status checking of certs.  OCSP was
>artificially limited to "as bad as CRL checking."

Could I just sort of mention in passing here that while people are voting on
what colour to make the lipstick there's already a protocol that solves pretty
much all of OCSP's long list of problems that was proposed as a replacement
for OCSP more than a decade ago (and has been in active use in all that time):

http://tools.ietf.org/html/draft-gutmann-cms-rtcs-01

It'd be pretty easy to turn this into an RFC, it just needs to be published...

Peter.