I am the assigned Gen-ART reviewer for: draft-ietf-pkix-lightweight-ocsp-profile-08.txt

For background on Gen-ART, please see the FAQ at <http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html>. Please resolve these comments along with any other Last Call comments you may receive.

Note that since assignment this document was updated to: draft-ietf-pkix-lightweight-ocsp-profile-09.txt and I reviewed the v.09

This draft is basically ready for publication, but has nits that should be fixed before publication.

Nits Outstanding:

** Obsolete normative reference: RFC 2246 (ref. 'TLS')
   (Obsoleted by RFC 4346)
** Obsolete normative reference: RFC 3546 (ref. 'TLSEXT')
   (Obsoleted by RFC 4366)

There is a direct reference to "3.6. Certificate Status Request" in RFC 3546 inline in the text but a diff on sec 3.6 in 3546 vs 4366 shows only a few changes in punctuation and line breaks (see attached). Is there a reason why these Refs have not been updated?

History:

The last substantive discussions of this draft on the WG list happened in 2004.

A Last Call Notice was posted Thu, 15 Jun 2006 (v.05) and Ron Bonica reviewed the document at that time: http://www.alvestrand.no/ietf/gen/reviews/draft-ietf-pkix-lightweight-ocsp-profile-05-bonica.txt At that time the document was tagged as Informational. The document moved to "Proposed Standard" with v.07.

There have been several DISCUSS tokens set on this document and the tracker doesn't show the final resolution but given that Sam and Russ are still sitting, I'll assume that their concerns have been addressed. I note that David Kessens flagged the use of SHA1 as a requirement in a comment and I'm guessing that a change in that requirement would require an amendment to the current document if it advances to standard.

Review Comments:

One small area of confusion. Is there a potential for a gap in timely update given both a "tolerance period" (sec 3) and "using the cache-control:max-age directive (sec 5.1) in time-based calculations ??? Sorry if I'm being dense here.

Revision Only Comments:

If/when the document gets another revision, two small changes in sec. 1.2.1 OCSPResponse Structure

  "In the case a responder does not have the ability to respond"
              ^ where

and

  "case a responder only"
       ^ where


Other Remarks:

Learn something new every time: sec 5 "aka stapling". Cool.


- Lucy
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>
<html><head><!-- Generated by rfcdiff 1.33: rfcdiff - -stdout - -html 
tmp/1/3546.txt tmp/2/4366.txt --><!-- <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 
4.01 Transitional" > --><!-- System: Linux cabernet.verkstad.net 2.6.8-2-686 #1 
Tue Aug 16 13:22:48 UTC 2005 i686 GNU/Linux --><!-- Using awk: /usr/bin/gawk: 
GNU Awk 3.1.5 --><!-- Using diff: /usr/bin/diff: diff (GNU diffutils) 2.8.1 
--><!-- Using wdiff: /usr/bin/wdiff: GNU wdiff 0.5 -->
 
 

 
 
 
 
 
 
  <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> 
  <meta http-equiv="Content-Style-Type" content="text/css"><title>Diff: 
3546.txt - 4366.txt</title> 
   
  <style type="text/css"> 
    body    { margin: 0.4ex; margin-right: auto; } 
    tr      { } 
    td      { white-space: pre; font-family: monospace; vertical-align: top; 
font-size: 0.86em;} 
    th      { font-size: 0.86em; } 
    .small  { font-size: 0.6em; font-style: italic; font-family: Verdana, 
Helvetica, sans-serif; } 
    .left   { background-color: #EEE; } 
    .right  { background-color: #FFF; } 
    .diff   { background-color: #CCF; } 
    .lblock { background-color: #BFB; } 
    .rblock { background-color: #FF8; } 
    .insert { background-color: #8FF; } 
    .delete { background-color: #ACF; } 
    .void   { background-color: #FFB; } 
    .cont   { background-color: #EEE; } 
    .linebr { background-color: #AAA; } 
    .lineno { color: red; background-color: #FFF; font-size: 0.7em; text-align: 
right; padding: 0 2px; } 
    .elipsis{ background-color: #AAA; } 
    .left .cont { background-color: #DDD; } 
    .right .cont { background-color: #EEE; } 
    .lblock .cont { background-color: #9D9; } 
    .rblock .cont { background-color: #DD6; } 
    .insert .cont { background-color: #0DD; } 
    .delete .cont { background-color: #8AD; } 
    .stats, .stats td, .stats th { background-color: #EEE; padding: 2px 0; } 
  </style></head><body> 
  <table border="0" cellpadding="0" cellspacing="0"> 
  <tbody><tr bgcolor="orange"><th></th><th>&nbsp;3546.txt&nbsp;</th><th> 
</th><th>&nbsp;4366.txt&nbsp;</th><th></th></tr> 
      <tr><td class="lineno"></td><td class="left"></td><td> </td><td 
class="right"></td><td class="lineno"></td></tr>
      <tr bgcolor="gray"><td></td><th><a name="part-l1"><small>skipping to 
change at</small><em> line 35</em></a></th><th> </th><th><a 
name="part-r1"><small>skipping to change at</small><em> line 
35</em></a></th><td></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">          
ResponderID responder_id_list&lt;0..2^16-1&gt;;</td><td> </td><td 
class="right">          ResponderID responder_id_list&lt;0..2^16-1&gt;;</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">          
Extensions  request_extensions;</td><td> </td><td class="right">          
Extensions  request_extensions;</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">      } 
OCSPStatusRequest;</td><td> </td><td class="right">      } 
OCSPStatusRequest;</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">      opaque 
ResponderID&lt;1..2^16-1&gt;;</td><td> </td><td class="right">      opaque 
ResponderID&lt;1..2^16-1&gt;;</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">      opaque 
Extensions&lt;0..2^16-1&gt;;</td><td> </td><td class="right">      opaque 
Extensions&lt;0..2^16-1&gt;;</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   In the 
OCSPStatusRequest, the "ResponderIDs" provides a list of OCSP</td><td> </td><td 
class="right">   In the OCSPStatusRequest, the "ResponderIDs" provides a list 
of OCSP</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   responders 
that the client trusts.  A zero-length "responder_id_list"</td><td> </td><td 
class="right">   responders that the client trusts.  A zero-length 
"responder_id_list"</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   sequence has 
the special meaning that the responders are implicitly</td><td> </td><td 
class="right">   sequence has the special meaning that the responders are 
implicitly</td><td class="lineno" valign="top"></td></tr>
      <tr><td><a name="diff0001"></a></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock">   known to 
the server<span class="delete"> -</span> e.g., by prior arrangement.  
"Extensions" is a</td><td> </td><td class="rblock">   known to the server<span 
class="insert">,</span> e.g., by prior arrangement.  "Extensions" is a</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   DER encoding 
of OCSP request extensions.</td><td> </td><td class="right">   DER encoding of 
OCSP request extensions.</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   Both 
"ResponderID" and "Extensions" are DER-encoded ASN.1 types as</td><td> </td><td 
class="right">   Both "ResponderID" and "Extensions" are DER-encoded ASN.1 
types as</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   defined in 
[OCSP].  "Extensions" is imported from [PKIX].  A zero-</td><td> </td><td 
class="right">   defined in [OCSP].  "Extensions" is imported from [PKIX].  A 
zero-</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   length 
"request_extensions" value means that there are no extensions</td><td> </td><td 
class="right">   length "request_extensions" value means that there are no 
extensions</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   (as opposed 
to a zero-length ASN.1 SEQUENCE, which is not valid for</td><td> </td><td 
class="right">   (as opposed to a zero-length ASN.1 SEQUENCE, which is not 
valid for</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   the 
"Extensions" type).</td><td> </td><td class="right">   the "Extensions" 
type).</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   In the case 
of the "id-pkix-ocsp-nonce" OCSP extension, [OCSP] is</td><td> </td><td 
class="right">   In the case of the "id-pkix-ocsp-nonce" OCSP extension, [OCSP] 
is</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   unclear 
about its encoding; for clarification, the nonce MUST be a</td><td> </td><td 
class="right">   unclear about its encoding; for clarification, the nonce MUST 
be a</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   DER-encoded 
OCTET STRING, which is encapsulated as another OCTET</td><td> </td><td 
class="right">   DER-encoded OCTET STRING, which is encapsulated as another 
OCTET</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   STRING (note 
that implementations based on an existing OCSP client</td><td> </td><td 
class="right">   STRING (note that implementations based on an existing OCSP 
client</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   will need to 
be checked for conformance to this requirement).</td><td> </td><td 
class="right">   will need to be checked for conformance to this 
requirement).</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   Servers that 
receive a client hello containing the "status_request"</td><td> </td><td 
class="right">   Servers that receive a client hello containing the 
"status_request"</td><td class="lineno" valign="top"></td></tr>
      <tr><td><a name="diff0002"></a></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock">   
extension<span class="delete">,</span> MAY return a suitable certificate status 
response to the</td><td> </td><td class="rblock">   extension MAY return a 
suitable certificate status response to the</td><td class="lineno" 
valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   client along 
with their certificate.  If OCSP is requested, they</td><td> </td><td 
class="right">   client along with their certificate.  If OCSP is requested, 
they</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   SHOULD use 
the information contained in the extension when selecting</td><td> </td><td 
class="right">   SHOULD use the information contained in the extension when 
selecting</td><td class="lineno" valign="top"></td></tr>
      <tr><td><a name="diff0003"></a></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock">   an OCSP 
responder<span class="delete">,</span> and SHOULD include request_extensions in 
the OCSP</td><td> </td><td class="rblock">   an OCSP responder and SHOULD 
include request_extensions in the OCSP</td><td class="lineno" 
valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   
request.</td><td> </td><td class="right">   request.</td><td class="lineno" 
valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   Servers 
return a certificate response along with their certificate by</td><td> </td><td 
class="right">   Servers return a certificate response along with their 
certificate by</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   sending a 
"CertificateStatus" message immediately after the</td><td> </td><td 
class="right">   sending a "CertificateStatus" message immediately after 
the</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   
"Certificate" message (and before any "ServerKeyExchange" or</td><td> </td><td 
class="right">   "Certificate" message (and before any "ServerKeyExchange" 
or</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   
"CertificateRequest" messages).  If a server returns a</td><td> </td><td 
class="right">   "CertificateRequest" messages).  If a server returns a</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td><a name="diff0004"></a></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> 
</td><td class="rblock"><span class="insert">                                   
                                      </span></td><td class="lineno" 
valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   
"CertificateStatus" message, then the server MUST have included an</td><td> 
</td><td class="right">   "CertificateStatus" message, then the server MUST 
have included an</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   extension of 
type "status_request" with empty "extension_data" in the</td><td> </td><td 
class="right">   extension of type "status_request" with empty "extension_data" 
in the</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   extended 
server hello.</td><td> </td><td class="right">   extended server hello.</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">      struct 
{</td><td> </td><td class="right">      struct {</td><td class="lineno" 
valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">          
CertificateStatusType status_type;</td><td> </td><td class="right">          
CertificateStatusType status_type;</td><td class="lineno" 
valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">          
select (status_type) {</td><td> </td><td class="right">          select 
(status_type) {</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">              
case ocsp: OCSPResponse;</td><td> </td><td class="right">              case 
ocsp: OCSPResponse;</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">          } 
response;</td><td> </td><td class="right">          } response;</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">      } 
CertificateStatus;</td><td> </td><td class="right">      } 
CertificateStatus;</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno"></td><td class="left"></td><td> </td><td 
class="right"></td><td class="lineno"></td></tr>
      <tr bgcolor="gray"><td></td><th><a name="part-l2"><small>skipping to 
change at</small><em> line 89</em></a></th><th> </th><th><a 
name="part-r2"><small>skipping to change at</small><em> line 
90</em></a></th><td></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   message type 
"certificate_status".</td><td> </td><td class="right">   message type 
"certificate_status".</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   Note that a 
server MAY also choose not to send a "CertificateStatus"</td><td> </td><td 
class="right">   Note that a server MAY also choose not to send a 
"CertificateStatus"</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   message, 
even if it receives a "status_request" extension in the</td><td> </td><td 
class="right">   message, even if it receives a "status_request" extension in 
the</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   client hello 
message.</td><td> </td><td class="right">   client hello message.</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   Note in 
addition that servers MUST NOT send the "CertificateStatus"</td><td> </td><td 
class="right">   Note in addition that servers MUST NOT send the 
"CertificateStatus"</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   message 
unless it received a "status_request" extension in the client</td><td> </td><td 
class="right">   message unless it received a "status_request" extension in the 
client</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left">   hello 
message.</td><td> </td><td class="right">   hello message.</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="left"></td><td> 
</td><td class="right"></td><td class="lineno" valign="top"></td></tr>
      <tr><td><a name="diff0005"></a></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock">   Clients 
requesting an OCSP <span class="delete">response,</span> and receiving an OCSP 
response</td><td> </td><td class="rblock">   Clients requesting an OCSP <span 
class="insert">response</span> and receiving an OCSP response in</td><td 
class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock">   in a 
"CertificateStatus" message MUST check the OCSP response and</td><td> </td><td 
class="rblock">   a "CertificateStatus" message MUST check the OCSP response 
and abort</td><td class="lineno" valign="top"></td></tr>
      <tr><td class="lineno" valign="top"></td><td class="lblock">   abort the 
handshake if the response is not <span 
class="delete">satisfactory.</span></td><td> </td><td class="rblock">   the 
handshake if the response is not <span 
class="insert">satisfactory</span></td><td class="lineno" 
valign="top"></td></tr>

     <tr><td></td><td class="left"></td><td> </td><td 
class="right"></td><td></td></tr>
     <tr bgcolor="gray"><th colspan="5" align="center"><a name="end">&nbsp;End 
of changes. 5 change blocks.&nbsp;</a></th></tr>
     <tr class="stats"><td></td><th><i>3 lines changed or 
deleted</i></th><th><i> </i></th><th><i>4 lines changed or 
added</i></th><td></td></tr>
     <tr><td colspan="5" class="small" align="center"><br>This html diff was 
produced by rfcdiff 1.33. The latest version is available from <a 
href="http://www.tools.ietf.org/tools/rfcdiff/";>http://tools.ietf.org/tools/rfcdiff/</a>
 </td></tr>
   </tbody></table>
   
</body></html>
_______________________________________________
Gen-art mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/gen-art

Reply via email to