Subject: RE: OCSP and PKINIT, take two

From: Medvinsky Alexander-MGI1174 <[email-masked]>
Date: Wed, 14 Jul 2004 17:27:30 -0700

I don't think that this should be a requirement to implement for all PKINIT clients or KDCs, given that there are alternatives such as using CRLs or using OCSP protocol directly with an OCSP responder.  And CRLs can be specified inside CMS messages, so that a client could check revocation status of a KDC cert directly from a PKINIT pre-auth.

Sasha.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Nicolas Williams
Sent: Wednesday, July 14, 2004 4:57 PM
To: Brian Tung
Cc: [email-masked]
Subject: Re: OCSP and PKINIT, take two

On Wed, Jul 14, 2004 at 03:22:36PM -0700, Brian Tung wrote:
> Nicolas Williams wrote:
> > Summary:  I believe support for PKINIT peers to send OCSP responses for
> >           their certs to each other should be a requirement.  Further, I
> > 	  believe this requirement can be satisfied without modification
> > 	  to the PKINIT ASN.1 types/PDUs.  Further, this can be done in
> > 	  the same document as PKINIT or in a separate document.
> 
> First of all, I agree that this requirement (if it becomes one) can be 
> satisfied without modification to the existing PKINIT ASN.1 types. I 
> also agree that it would make sense to put them in a separate preauth.
> 
> However, assuming I stipulate to requiring the OCSP responses, I don't 
> see that it makes much sense to put it in another draft.  In order to 
> verify that I am compliant with PKINIT, I should have to check the 
> PKINIT draft *plus* the OCSP add-on draft?

I propose separate I-Ds for two reasons:

 - to gain the approval of implementors who don't care about OCSP
 - my I-D is so, so simple that it might pass WG Last-Call before
   PKINIT...

> But I also don't see that supporting this has to be a requirement (for 
> both sides) for PKINIT compliance.  Can you explain your rationale for 
> it being a requirement?

I meant that it should be a design requirement, not a requirement for every PKINIT exchange.

I also think that all new protocols that use PK certs should have this feature.

Cheers,

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 14 Jul 2004 23:58:02 -0500

> I don't think that this should be a requirement to implement for all PKINIT clients or KDCs, given that there are alternatives such as using CRLs or using OCSP protocol directly with an OCSP respon…

I agree that this feature need not (must not be) a requirement to
implement.  As I wrote:

> BRIAN> But I also don't see that supporting this has to be a
> BRIAN> requirement (for both sides) for PKINIT compliance.  Can you
> BRIAN> explain your rationale for it being a requirement?
> 

Nico
--