RE: OCSP response pre-production

["Ryan M. Hurst" <rmh@xxxxxxxxxxxxxxxxxxxxx>]

I concur with this, er "me too" :)

Ryan

-----Original Message-----
From: Paul Hoffman / IMC [mailto:phoffman@xxxxxxx] 
Sent: Friday, September 26, 2003 9:40 AM
To: Michael Myers; Ryan M. Hurst; David Engberg; oelmaier@xxxxxxxxxxx;
Ambarish Malpani; ietf-pkix@xxxxxxx
Cc: Russ Housley; Stephen Kent; Tim Polk
Subject: RE: OCSP response pre-production

I hate to send "me too" responses, but everything Mike says in his 
extended discussion is exactly right. My summary would be:

- If you can't sign, you must reject requests with nonces.

- Caching servers can ask a different server to sign. They can 
respond to all requests that don't ahve nonces, and they (probably 
selectively) send back the requests that have nonces to a server 
willing to sign them.

- If you control the OCSP clients and you don't want to sign the 
responses, inhibit the clients from sending requests with nonces.


--Paul Hoffman, Director
--Internet Mail Consortium