Subject: Re: [pkix] Update to OCSP Must Staple draft

From: "Ben Wilson" <[email-masked]>
Date: Wed, 23 Jan 2013 12:55:28 -0700

Has this issue with the "Must Staple" OID been resolved? 

CABF was looking at adopting "2.23.140.16.1"  2.23.140 is the
ca-browser-forum, 16 is ocsp, and 1 would become "must-staple".  (I'm
currently working on OCSP stapling fixes to section 13.2.1 and appendix B of
the CABF's Baseline Requirements.)

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Phillip Hallam-Baker
Sent: Wednesday, November 14, 2012 7:27 PM
To: [email-masked]
Subject: [pkix] Update to OCSP Must Staple draft

Following conversations at IETF I have removed the minimum version attribute
from the Must Staple draft. Basically Ryan Sleevi explained the pool of woe
and misery that is TLS version numbering and so I dropped it.

The updated version of the draft is

http://www.ietf.org/id/draft-hallambaker-tlssecuritypolicy-03.txt

This is not a WG item of course but is of interest to folk here.

The main outstanding issue is whether the OID should be cut from the IETF
PKIX arc or some other arc (e.g. CABForum). After discussion with Russ (the
secretary) and Stephan (as WG chair) it seems that the best approach would
be to put it on the PKIX arc so that people know where to look to find the
description (i.e. an RFC).

This might raise an issue that the WG may need to consider before it closes,
namely what the ongoing registration policy is going to be for PKIX OIDs
when the registration function reverts to IANA.

-- 
Website: http://hallambaker.com/

---

From: "Ben Wilson" <[email-masked]>
Date: Sun, 27 Jan 2013 15:10:37 -0700

All,

I'm trying to close an open issue from the CAB Forum's September meeting.
(I think that some of CABF  members would like to move forward with further
testing of OCSP stapling scenarios, and it would be better before CAB Forum
members move forward with the must-staple OID listed below, it would be
better to give this community one last opportunity to promulgate one.)  Last
Thursday when Phill and I discussed this issue during the CABF call, he said
that he had not seen a response on this issue, but that members of this
group had previously expressed the desire that the OID be within the PKIX
space in case other people wanted to take a look at it and see how the OID
is supposed to be treated, etc.   Also, would it be better to move this
discussion to the therightkey mailing list because if anyone is going to do
a certificate pointer on must-staple OCSP, then maybe someone ought to
identify the OID for delivery of CT proofs through stapled OCSP?

Thanks,

Ben    

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ben
Wilson
Sent: Wednesday, January 23, 2013 12:55 PM
To: 'Phillip Hallam-Baker'; [email-masked]
Subject: Re: [pkix] Update to OCSP Must Staple draft

---

From: Stephen Kent <[email-masked]>
Date: Wed, 30 Jan 2013 13:25:57 -0500

Ben,

PKIX will not consider any new work items, as noted previously. So, I 
suggest you contact
Sean Turner to see what he suggets re how to pursue OCSP stapling in the 
IETF.

Steve

---

From: "Ben Wilson" <[email-masked]>
Date: Wed, 30 Jan 2013 11:31:26 -0700

Thanks, Steve.  Sean - drop me an email on this.  
Thanks,
Ben

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Wednesday, January 30, 2013 11:26 AM
To: [email-masked]; pkix; Sean Turner
Subject: Re: [pkix] Update to OCSP Must Staple draft

Ben,

PKIX will not consider any new work items, as noted previously. So, I
suggest you contact Sean Turner to see what he suggets re how to pursue OCSP
stapling in the IETF.

Steve