Re: RE: Security section of draft-ietf-pkix-opp-ftp-http

[Paul Hoffman / IMC <phoffman@xxxxxxx>]

After talking to David Kemp, I'd like to propose an additional paragraph to
the one I had already proposed for the security section:

If a CA issues one or more CRLs before the nextUpdate time
of a previous CRL, a requestor has no way of ensuring that a CRL
received from that CA is the most current one available.  Caching,
repository updating, and man-in-the-middle attacks may all result in
a valid but outdated CRL being accepted by the requestor without the
requestor knowing that a newer CRL is available.


--Paul Hoffman, Director
--Internet Mail Consortium