Re: Algorithm revocation

[Stephen Kent <kent@xxxxxxx>]

Soenke,

While I am sympathetic to the concern that motivated the suggestion 
of revoking an algorithm, I think the list discussion has pointed out 
pitfalls with the proposed approach. Fundamentally, a decision to 
accept or reject use of algorithm is more an RP issue that a CA 
revocation issue.  I am less sympathetic to the proposed dual 
signature proposal for PKI data structures, including your specific 
OCSP example. Use of multiple signatures are appropriate in some 
application contexts, but have been explored and rejected in X.509 
infrastructure data elements, e.g., certs & CRLs, long ago.

Steve