RE: DPD & DPV requirements - Let us Recurse

[Stephen Kent <kent@xxxxxxx>]

Carlin,

> Steve Kent's DPD/DPV requirements, the SCVP proposal, and the OCSP DPD proposal all permit OCSP responses
> to be returned to the client as revocation status data.  Presumably in each case this refers to OCSP v1 basic responses,
> at least.  This is all well and good, but would it not be desirable to also permit recursion in the DPD response?  That is, the DPD
> response might include an embedded DPD response from another server.  Among other benefits, this would preserve the
> timestamp (if any) on the embedded DPD response.
>
>
> - Regards
> Carlin Covey
> Cylink Corp.

Recursion has its attractions, but nested responses seem complex, syntactically if not semantically. Given the issues you raised about the 1 level of indirection posed by a DPD or DPV server interacting with an OCSP server, I am not yet comfortable with making life more complex in this regard.  First I think we need to solve the problem you identified, and then we can see if that solution will generalize to allow the recursion to work smoothly and in a readily understandable manner.

Steve