<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoPlainText>Then maybe it could/should work like this?<o:p></o:p></p><p class=MsoPlainText> - Sender sends a signed message <o:p></o:p></p><p class=MsoPlainText> - The Sender's certificate gets suspended<o:p></o:p></p><p class=MsoPlainText> - Recipient tries to verify the signature and is told that the Sender's certificate is <span style='color:red'>SUSPENDED</span><o:p></o:p></p><p class=MsoPlainText> - The Sender's certificate gets unsuspended<o:p></o:p></p><p class=MsoPlainText> - Recipient tries to verify the signature from a save folder and is told that the signature is fine<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----Original Message-----<br>From: Smcwg-public <smcwg-public-bounces@cabforum.org> On Behalf Of Russ Housley via Smcwg-public<br>Sent: Thursday, August 25, 2022 1:30 PM<br>To: Dimitris Zacharopoulos (HARICA) <dzacharo@harica.gr><br>Cc: SMIME Certificate Working Group <smcwg-public@cabforum.org><br>Subject: Re: [Smcwg-public] Certificate Suspension</p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Dimitris:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>>> I tend to agree with Stephen. I am unaware of any S/MIME client software that would handle a certificate suspension any differently that a revocation.<o:p></o:p></p><p class=MsoPlainText>> <o:p></o:p></p><p class=MsoPlainText>> Which is perfectly fine and expected when a certificate is "suspended" (i.e. not to be trusted at time of verification). If a S/MIME client software wants to provide some kind of different UI message like "this certificate is currently suspended" instead of "the signing certificate is revoked" and explain what that means, IMO that would be an improvement similar to what's happening with the server TLS user agents providing different user experience depending on the revocationReason code.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>This is a topic that has been discussed over and over since the mid 1990s. It never gets consensus in either direction. I predict that will be the case here too.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I worry about the following series of events leads to confused user:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> - Sender sends a signed message <o:p></o:p></p><p class=MsoPlainText> - The Sender's certificate gets suspended<o:p></o:p></p><p class=MsoPlainText> - Recipient tries to verify the signature and is told that the Sender's certificate is revoked<o:p></o:p></p><p class=MsoPlainText> - The Sender's certificate gets unsuspended<o:p></o:p></p><p class=MsoPlainText> - Recipient tries to verify the signature from a save folder and is told that the signature is fine<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>A normal human will not understand what happened.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Russ<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>_______________________________________________<o:p></o:p></p><p class=MsoPlainText>Smcwg-public mailing list<o:p></o:p></p><p class=MsoPlainText>Smcwg-public@cabforum.org<o:p></o:p></p><p class=MsoPlainText>https://lists.cabforum.org/mailman/listinfo/smcwg-public<o:p></o:p></p></div></body></html>