RE: OCSP response pre-production

["Miguel Rodriguez" <mars@xxxxxxxxxxxxxx>]

Cached (pre-produced) responses can be treated as CRLs (checked for time
validity using the ThisUpdate and NextUpdate fields). We don't worry
about replay attacks when using CRLs. 

If we want to enable the client to work with both fresh and cached
responses we could include a nonce in the request and accept responses
without it. Of course this means that we are giving up prevention
against replay attacks. This prevention only makes sense for fresh
responses. The bad scenario is a replay attack for fresh responses, how
can we avoid it? Maybe by having a way to distinguish fresh responses
from cached ones. Then the client can reject a fresh response without
the nonce included in the request. 

Opinions are welcomed,

Miguel A Rodriguez
SeguriDATA 
Mexico