Subject: Re: [lamps] Considerations about the need to resume PKIX work

From: "Dr. Pala" <[email-masked]>
Date: Tue, 1 Aug 2017 09:12:09 -0600

Hi Rich, all,

I do really hope we will be able to provide some alternatives that might 
work in different environments - I will try to make more formal 
proposals soon for the charter items and milestones. Depending on which 
direction the WG wants to go, I'd be happy to help with the 
implementation in OpenSSL. We do have some sample code for OCSP over DNS 
for our OCSP responder - it is just demo code (not even close to be 
production ready :D) but it might be used as an example :D

I think few optimizations might be low-hanging fruits (e.g., 
distribution of rev info via DNS, reducing the response size for 
non-revoked entries) and some others might require more creative 
thinking (e.g., cumulative responses for full-chain validation).

These are just examples, and I am curious to know if there are other 
possible proposals on the table...

Cheers,
Max

On 7/31/17 10:27 AM, Salz, Rich wrote:
>
> I am also curious to see what concrete things could be done to improve 
> revocation.  If the answer is “nothing” that’s okay, but if it’s not, 
> I expect OpenSSL will have to write some code J
>
> [...] 

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo

---

From: Dmitry Belyavsky <[email-masked]>
Date: Sat, 12 Aug 2017 23:18:41 +0300

Hello,

On Tue, Aug 1, 2017 at 6:12 PM, Dr. Pala <[email-masked]> wrote:

> work in different environments - I will try to make more formal proposals
> soon for the charter items and milestones. Depending on which direction the
> WG wants to go, I'd be happy to help with the implementation in OpenSSL. We
> do have some sample code for OCSP over DNS for our OCSP responder - it is
> just demo code (not even close to be production ready :D) but it might be
> used as an example :D
>
> I think few optimizations might be low-hanging fruits (e.g., distribution
> of rev info via DNS, reducing the response size for non-revoked entries)
> and some others might require more creative thinking (e.g., cumulative
> responses for full-chain validation).
>

I would like to remind about my draft describing application-level
revocation.

Thank you!

-- 
SY, Dmitry Belyavsky

---

From: Dmitry Belyavsky <[email-masked]>
Date: Sun, 13 Aug 2017 10:38:25 +0300

Hello,

> I would like to remind about my draft describing application-level

Just to clarify. My draft describes practice that already is in use in
browsers. Now the limitations and partial revocations are hard coded, I
suggest a way to make them alienable.

-- 
SY, Dmitry Belyavsky