<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>OCSP and CRLs are two different methodologies. The more they are de-coupled, the more each can evolve and improve. That is not to say that they have to be divorced, and implementations could still tie the two together. Take RFC 2560 bis, for example, “1” for CertStatus could simply mean “bad” and then if revocationReason is populated with CRLReason, then the assumption should be that the CRL has been updated and is the source of the OCSP Response. If it is not populated, then it should not be assumed that the CRL will match. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>For legacy applications, people should not use an RFC 2560 CertStatus response of “1” to mean that the serial number has to be placed on a CRL. “Revoked” for OCSP is different than “revoked” for CRL, yet both should have the same meaning for communicating to the client that the certificate is unreliable and a client should hard fail in that case – “upon transmission or receipt of a fatal alert message, both parties immediately close the connection”. Revocation is just a matter that depends on the technology being used. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Finally, the straw poll is not about making a signed response of revoked mandatory, because existing options of “Unknown” and “Unauthorized” exist, as Eddy notes. I don’t think clients should cache an OCSP response forever. If the client thinks that the OCSP response of revoked was incorrect, it should query again and if the OCSP response says “good” then this is not an issue. As noted in the straw poll, current conventional wisdom is that allow such behavior does no harm.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> <o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Eddy Nigg (StartCom Ltd.)<br><b>Sent:</b> Tuesday, October 30, 2012 5:06 PM<br><b>To:</b> public@cabforum.org<br><b>Subject:</b> Re: [cabfpub] Fwd: [pkix] Straw-poll on OCSP responses for non-revoked certificates.<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><br>On 10/30/2012 11:47 PM, From Eddy Nigg (StartCom Ltd.): <o:p></o:p></p><p class=MsoNormal>Neither - an OCSP responder should respond with "Unknown" or "Unauthorized" in case the certificate is unknown. Or either "Good" or "Revoked" for known ones.<br><br>Rational - responding "Revoked" for a certificate that might be good, is incorrect, either due to migration and update time or other reasons (out-of-sync cor whatever). Clients may cache revoked responses forever, revoked certificates are never unrevoked.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><br>I hope the folks from the PKIX forum follow the CAB Forum public list - it wasn't obvious to me that this mail was forwarded. Well, well... :-)<br><br><o:p></o:p></p><div><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0><tr><td colspan=2 style='padding:0in 0in 0in 0in'><p class=MsoNormal>Regards <o:p></o:p></p></td></tr><tr><td colspan=2 style='padding:0in 0in 0in 0in'><p class=MsoNormal> <o:p></o:p></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal>Signer: <o:p></o:p></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal>Eddy Nigg, COO/CTO<o:p></o:p></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal> <o:p></o:p></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><a href="http://www.startcom.org">StartCom Ltd.</a><o:p></o:p></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal>XMPP: <o:p></o:p></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a><o:p></o:p></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal>Blog: <o:p></o:p></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><a href="http://blog.startcom.org">Join the Revolution!</a><o:p></o:p></p></td></tr><tr><td style='padding:0in 0in 0in 0in'><p class=MsoNormal>Twitter: <o:p></o:p></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal><a href="http://twitter.com/eddy_nigg">Follow Me</a><o:p></o:p></p></td></tr><tr><td colspan=2 style='padding:0in 0in 0in 0in'><p class=MsoNormal> <o:p></o:p></p></td></tr></table></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>