RE: German Law and OCSP

["Salz, Rich" <SalzR@xxxxxxxxxx>]

>c. The responder (VA) verify that the cert was contained in "the"
directory.

Is VA now a generic term for OCSP responder?  I thought you guys trademarked
it. Be careful, you don't want to go the way of kleenex... :)

>ANOTHER CERTIFICATE WITH THE SAME
>SERIAL NUMBER WAS ISSUED AND IS IN THE DIRECTORY!

How so?  Since the certID includes the issuerNameHash, it identifies the
issuer, and since the issuer doesn't re-use serial#'s,...  There are
performance impliciations -- it might require a directory to index by
HASH(issuer_dn) -- but that seems surmountable.  There are other approaches,
such as having an OCSP responder which gets both certs and crl's, not just
revocation data.  (Modesty prevents me from naming names :)

It also puts the directory into part of the trusted base.  In general
directories aren't put there, but if that's what the lawyers wrote, then
we techies can only comply.