RE: DPD & DPV requirements - Recursion Issues

[Michael Myers <MMyers@xxxxxxxxxxxx>]

Steve,

> On Friday, January 12, 2001 3:19 PM you wrote:
> . . . 
> the question I asked was whether the OCSP response carried data that 
> tied it to a requestor, not a responder.

As Rick Salz noted, RFC 2560 enables such binding via the nonce mechanism.
Use of this mechanism is not however mandated.  Also, Rich Akney was a
strong advocate of the OPTIONAL requestorName syntax in an OCSP request.
The definition of the production of response signature in RFC 2560 does not
include the contents of the request in its hash.  We might wish to consider
amending this in the OCSPv2 I-D but it's not yet clear to me that we should
inhibit response transparency.  A relying party might very well wish to know
who is ultimately standing behind a certificate.

Mike