RE: The Meaning of Hold

[Stephen Kent <kent@xxxxxxx>]

Mike,

Hold adds some compexity for non-repudiation applications, but probably not
much for simple authentication and access control applications.  In the
latter case, at the time the data is checked or access is requested, one
just looks at the current CRL.  In the N-R case, it is always critical to
have a transaction time stamped, and to collect the relevant certs and
CRLs.  If the CRL that covers the time at which the transaction took place
does not have any of the relevant certs in question on it, even in hold
status, then you're done.  If one of the relevant certs is added later,
it's not your problem: you already have the needed data to substantiate
your claim.  The potentially transient nature of a cert on a CRL due to the
hold condition is bothersome to me, as it complicates the model and makes
it harder to explain to folks, but in practice I don't think it unduly
complicates processing in either case.

Steve