I am the assigned Gen-ART reviewer for:
draft-ietf-pkix-lightweight-ocsp-profile-08.txt
For background on Gen-ART, please see the FAQ at
<http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html>. Please resolve
these comments along with any other Last Call comments you may receive.
Note that since assignment this document was updated to:
draft-ietf-pkix-lightweight-ocsp-profile-09.txt and I reviewed the v.09
This draft is basically ready for publication, but has nits that should be
fixed before publication.
Nits Outstanding:
** Obsolete normative reference: RFC 2246 (ref. 'TLS')
(Obsoleted by RFC 4346)
** Obsolete normative reference: RFC 3546 (ref. 'TLSEXT')
(Obsoleted by RFC 4366)
There is a direct reference to "3.6. Certificate Status Request"
in RFC 3546 inline in the text but a diff on sec 3.6 in 3546 vs 4366 shows
only a few changes in punctuation and line breaks (see attached). Is there
a reason why these Refs have not been updated?
History:
The last substantive discussions of this draft on the WG list happened in
2004.
A Last Call Notice was posted Thu, 15 Jun 2006 (v.05) and Ron Bonica
reviewed the document at that time:
http://www.alvestrand.no/ietf/gen/reviews/draft-ietf-pkix-lightweight-ocsp-profile-05-bonica.txt
At that time the document was tagged as Informational. The document moved
to "Proposed Standard" with v.07.
There have been several DISCUSS tokens set on this document and the
tracker doesn't show the final resolution but given that Sam and Russ are
still sitting, I'll assume that their concerns have been addressed. I note
that David Kessens flagged the use of SHA1 as a requirement in a comment
and I'm guessing that a change in that requirement would require an
amendment to the current document if it advances to standard.
Review Comments:
One small area of confusion. Is there a potential for a gap in timely
update given both a "tolerance period" (sec 3) and "using the
cache-control:max-age directive (sec 5.1) in time-based calculations ???
Sorry if I'm being dense here.
Revision Only Comments:
If/when the document gets another revision, two small changes in sec.
1.2.1 OCSPResponse Structure
"In the case a responder does not have the ability to respond"
^ where
and
"case a responder only"
^ where
Other Remarks:
Learn something new every time: sec 5 "aka stapling". Cool.
- Lucy<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head><!-- Generated by rfcdiff 1.33: rfcdiff - -stdout - -html
tmp/1/3546.txt tmp/2/4366.txt --><!-- <!DOCTYPE html PUBLIC "-//W3C//DTD HTML
4.01 Transitional" > --><!-- System: Linux cabernet.verkstad.net 2.6.8-2-686 #1
Tue Aug 16 13:22:48 UTC 2005 i686 GNU/Linux --><!-- Using awk: /usr/bin/gawk:
GNU Awk 3.1.5 --><!-- Using diff: /usr/bin/diff: diff (GNU diffutils) 2.8.1
--><!-- Using wdiff: /usr/bin/wdiff: GNU wdiff 0.5 -->
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta http-equiv="Content-Style-Type" content="text/css"><title>Diff:
3546.txt - 4366.txt</title>
<style type="text/css">
body { margin: 0.4ex; margin-right: auto; }
tr { }
td { white-space: pre; font-family: monospace; vertical-align: top;
font-size: 0.86em;}
th { font-size: 0.86em; }
.small { font-size: 0.6em; font-style: italic; font-family: Verdana,
Helvetica, sans-serif; }
.left { background-color: #EEE; }
.right { background-color: #FFF; }
.diff { background-color: #CCF; }
.lblock { background-color: #BFB; }
.rblock { background-color: #FF8; }
.insert { background-color: #8FF; }
.delete { background-color: #ACF; }
.void { background-color: #FFB; }
.cont { background-color: #EEE; }
.linebr { background-color: #AAA; }
.lineno { color: red; background-color: #FFF; font-size: 0.7em; text-align:
right; padding: 0 2px; }
.elipsis{ background-color: #AAA; }
.left .cont { background-color: #DDD; }
.right .cont { background-color: #EEE; }
.lblock .cont { background-color: #9D9; }
.rblock .cont { background-color: #DD6; }
.insert .cont { background-color: #0DD; }
.delete .cont { background-color: #8AD; }
.stats, .stats td, .stats th { background-color: #EEE; padding: 2px 0; }
</style></head><body>
<table border="0" cellpadding="0" cellspacing="0">
<tbody><tr bgcolor="orange"><th></th><th> 3546.txt </th><th>
</th><th> 4366.txt </th><th></th></tr>
<tr><td class="lineno"></td><td class="left"></td><td> </td><td
class="right"></td><td class="lineno"></td></tr>
<tr bgcolor="gray"><td></td><th><a name="part-l1"><small>skipping to
change at</small><em> line 35</em></a></th><th> </th><th><a
name="part-r1"><small>skipping to change at</small><em> line
35</em></a></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
ResponderID responder_id_list<0..2^16-1>;</td><td> </td><td
class="right"> ResponderID responder_id_list<0..2^16-1>;</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
Extensions request_extensions;</td><td> </td><td class="right">
Extensions request_extensions;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> }
OCSPStatusRequest;</td><td> </td><td class="right"> }
OCSPStatusRequest;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> opaque
ResponderID<1..2^16-1>;</td><td> </td><td class="right"> opaque
ResponderID<1..2^16-1>;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> opaque
Extensions<0..2^16-1>;</td><td> </td><td class="right"> opaque
Extensions<0..2^16-1>;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> In the
OCSPStatusRequest, the "ResponderIDs" provides a list of OCSP</td><td> </td><td
class="right"> In the OCSPStatusRequest, the "ResponderIDs" provides a list
of OCSP</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> responders
that the client trusts. A zero-length "responder_id_list"</td><td> </td><td
class="right"> responders that the client trusts. A zero-length
"responder_id_list"</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> sequence has
the special meaning that the responders are implicitly</td><td> </td><td
class="right"> sequence has the special meaning that the responders are
implicitly</td><td class="lineno" valign="top"></td></tr>
<tr><td><a name="diff0001"></a></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> known to
the server<span class="delete"> -</span> e.g., by prior arrangement.
"Extensions" is a</td><td> </td><td class="rblock"> known to the server<span
class="insert">,</span> e.g., by prior arrangement. "Extensions" is a</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> DER encoding
of OCSP request extensions.</td><td> </td><td class="right"> DER encoding of
OCSP request extensions.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Both
"ResponderID" and "Extensions" are DER-encoded ASN.1 types as</td><td> </td><td
class="right"> Both "ResponderID" and "Extensions" are DER-encoded ASN.1
types as</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> defined in
[OCSP]. "Extensions" is imported from [PKIX]. A zero-</td><td> </td><td
class="right"> defined in [OCSP]. "Extensions" is imported from [PKIX]. A
zero-</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> length
"request_extensions" value means that there are no extensions</td><td> </td><td
class="right"> length "request_extensions" value means that there are no
extensions</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> (as opposed
to a zero-length ASN.1 SEQUENCE, which is not valid for</td><td> </td><td
class="right"> (as opposed to a zero-length ASN.1 SEQUENCE, which is not
valid for</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> the
"Extensions" type).</td><td> </td><td class="right"> the "Extensions"
type).</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> In the case
of the "id-pkix-ocsp-nonce" OCSP extension, [OCSP] is</td><td> </td><td
class="right"> In the case of the "id-pkix-ocsp-nonce" OCSP extension, [OCSP]
is</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> unclear
about its encoding; for clarification, the nonce MUST be a</td><td> </td><td
class="right"> unclear about its encoding; for clarification, the nonce MUST
be a</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> DER-encoded
OCTET STRING, which is encapsulated as another OCTET</td><td> </td><td
class="right"> DER-encoded OCTET STRING, which is encapsulated as another
OCTET</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> STRING (note
that implementations based on an existing OCSP client</td><td> </td><td
class="right"> STRING (note that implementations based on an existing OCSP
client</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> will need to
be checked for conformance to this requirement).</td><td> </td><td
class="right"> will need to be checked for conformance to this
requirement).</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Servers that
receive a client hello containing the "status_request"</td><td> </td><td
class="right"> Servers that receive a client hello containing the
"status_request"</td><td class="lineno" valign="top"></td></tr>
<tr><td><a name="diff0002"></a></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock">
extension<span class="delete">,</span> MAY return a suitable certificate status
response to the</td><td> </td><td class="rblock"> extension MAY return a
suitable certificate status response to the</td><td class="lineno"
valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> client along
with their certificate. If OCSP is requested, they</td><td> </td><td
class="right"> client along with their certificate. If OCSP is requested,
they</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> SHOULD use
the information contained in the extension when selecting</td><td> </td><td
class="right"> SHOULD use the information contained in the extension when
selecting</td><td class="lineno" valign="top"></td></tr>
<tr><td><a name="diff0003"></a></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> an OCSP
responder<span class="delete">,</span> and SHOULD include request_extensions in
the OCSP</td><td> </td><td class="rblock"> an OCSP responder and SHOULD
include request_extensions in the OCSP</td><td class="lineno"
valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
request.</td><td> </td><td class="right"> request.</td><td class="lineno"
valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Servers
return a certificate response along with their certificate by</td><td> </td><td
class="right"> Servers return a certificate response along with their
certificate by</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> sending a
"CertificateStatus" message immediately after the</td><td> </td><td
class="right"> sending a "CertificateStatus" message immediately after
the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
"Certificate" message (and before any "ServerKeyExchange" or</td><td> </td><td
class="right"> "Certificate" message (and before any "ServerKeyExchange"
or</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
"CertificateRequest" messages). If a server returns a</td><td> </td><td
class="right"> "CertificateRequest" messages). If a server returns a</td><td
class="lineno" valign="top"></td></tr>
<tr><td><a name="diff0004"></a></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td>
</td><td class="rblock"><span class="insert">
</span></td><td class="lineno"
valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
"CertificateStatus" message, then the server MUST have included an</td><td>
</td><td class="right"> "CertificateStatus" message, then the server MUST
have included an</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> extension of
type "status_request" with empty "extension_data" in the</td><td> </td><td
class="right"> extension of type "status_request" with empty "extension_data"
in the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> extended
server hello.</td><td> </td><td class="right"> extended server hello.</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> struct
{</td><td> </td><td class="right"> struct {</td><td class="lineno"
valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
CertificateStatusType status_type;</td><td> </td><td class="right">
CertificateStatusType status_type;</td><td class="lineno"
valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
select (status_type) {</td><td> </td><td class="right"> select
(status_type) {</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">
case ocsp: OCSPResponse;</td><td> </td><td class="right"> case
ocsp: OCSPResponse;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> }
response;</td><td> </td><td class="right"> } response;</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> }
CertificateStatus;</td><td> </td><td class="right"> }
CertificateStatus;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno"></td><td class="left"></td><td> </td><td
class="right"></td><td class="lineno"></td></tr>
<tr bgcolor="gray"><td></td><th><a name="part-l2"><small>skipping to
change at</small><em> line 89</em></a></th><th> </th><th><a
name="part-r2"><small>skipping to change at</small><em> line
90</em></a></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> message type
"certificate_status".</td><td> </td><td class="right"> message type
"certificate_status".</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Note that a
server MAY also choose not to send a "CertificateStatus"</td><td> </td><td
class="right"> Note that a server MAY also choose not to send a
"CertificateStatus"</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> message,
even if it receives a "status_request" extension in the</td><td> </td><td
class="right"> message, even if it receives a "status_request" extension in
the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> client hello
message.</td><td> </td><td class="right"> client hello message.</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Note in
addition that servers MUST NOT send the "CertificateStatus"</td><td> </td><td
class="right"> Note in addition that servers MUST NOT send the
"CertificateStatus"</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> message
unless it received a "status_request" extension in the client</td><td> </td><td
class="right"> message unless it received a "status_request" extension in the
client</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> hello
message.</td><td> </td><td class="right"> hello message.</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"></td><td>
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
<tr><td><a name="diff0005"></a></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> Clients
requesting an OCSP <span class="delete">response,</span> and receiving an OCSP
response</td><td> </td><td class="rblock"> Clients requesting an OCSP <span
class="insert">response</span> and receiving an OCSP response in</td><td
class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> in a
"CertificateStatus" message MUST check the OCSP response and</td><td> </td><td
class="rblock"> a "CertificateStatus" message MUST check the OCSP response
and abort</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> abort the
handshake if the response is not <span
class="delete">satisfactory.</span></td><td> </td><td class="rblock"> the
handshake if the response is not <span
class="insert">satisfactory</span></td><td class="lineno"
valign="top"></td></tr>
<tr><td></td><td class="left"></td><td> </td><td
class="right"></td><td></td></tr>
<tr bgcolor="gray"><th colspan="5" align="center"><a name="end"> End
of changes. 5 change blocks. </a></th></tr>
<tr class="stats"><td></td><th><i>3 lines changed or
deleted</i></th><th><i> </i></th><th><i>4 lines changed or
added</i></th><td></td></tr>
<tr><td colspan="5" class="small" align="center"><br>This html diff was
produced by rfcdiff 1.33. The latest version is available from <a
href="http://www.tools.ietf.org/tools/rfcdiff/">http://tools.ietf.org/tools/rfcdiff/</a>
</td></tr>
</tbody></table>
</body></html>_______________________________________________
Gen-art mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/gen-art