Additional Cryptographic Message Syntax (CMS) Revocation Information Choices
Extracted elements (15)
CRL and Delta CRL were assigned OID numbers 1 and 3 under id-ri, but those formats use the crl CHOICE in RevocationInfoChoice directly rather than the 'other' CHOICE, so those OID values are not used via OtherRevocationInfoFormat.
SCVP allows unprotected and MAC-protected responses, but these cannot be validated by third parties who lack the connection context or shared key. This is why only digitally signed SCVP responses are permitted in SCVPReqRes when conveyed to third parties.
The OID arc id-ri is delegated by IANA to the PKIX Working Group; when that WG closes, the arc and registration procedures transfer to IANA. No IANA action beyond this delegation is required for this document.
SCVP responses sent to a third party MUST be signed by the SCVP server so that the third party can validate them, since unprotected or MAC-protected responses cannot be verified without the originating connection context or private key.
The 'other' CHOICE in RevocationInfoChoice MUST be used to convey OCSP responses, SCVP requests, and SCVP responses.
The SCVP request MUST always be included with the SCVP response when carried in SCVPReqRes, unless the response includes the requestRef fullRequest field.
When carrying an OCSP response, otherRevInfo MUST carry the OCSPResponse type; the responseStatus field MUST be successful and the responseBytes field MUST be present.
Within SCVPReqRes, the response ContentInfo MUST contain a signed SCVP response with responseStatus okay; unprotected and authenticated (MAC-only) responses MUST NOT be included.
RevocationInfoChoices is a SET OF RevocationInfoChoice, where each choice is either a CertificateList (CRL) or an OtherRevocationInfoFormat. The OtherRevocationInfoFormat contains an OID (otherRevInfoFormat) and any value defined by that OID (otherRevInfo).
The OID id-ri-ocsp-response ({ id-ri 2 }) identifies OCSP responses carried in the otherRevInfo field of OtherRevocationInfoFormat using the OCSPResponse type defined in RFC 2560.
The OID id-ri-scvp ({ id-ri 4 }) identifies SCVP request/response pairs carried in the otherRevInfo field using the SCVPReqRes structure, which is a SEQUENCE with an optional request ContentInfo and a mandatory response ContentInfo.
The id-ri arc is defined under the PKIX OID tree ({ pkix ri(16) }) as the registration point for revocation information format OIDs. Numbers 1 and 3 were previously assigned to CRL and Delta CRL but are not used via the 'other' CHOICE.
A client may locally store unprotected or authenticated SCVP responses by encapsulating them in a SignedData structure. Whether such client-signed encapsulations are considered valid by other entities is a matter of local policy.
The security considerations of CMS (RFC 5652), CMS-ASN (RFC 5911), OCSP (RFC 2560), SCVP (RFC 5055), and PROFILE-ASN (RFC 5912) all apply to this document.
SCVPReqRes is encoded as an ASN.1 SEQUENCE with two fields: request ([0] EXPLICIT ContentInfo, OPTIONAL) containing the SCVP request, and response (ContentInfo, mandatory) containing the signed SCVP response.