[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: OCSP response pre-production



(...)

[Florian]

Client Type I) Given you have a client with the following behaviour:
A) always includes a nonce into his request
B) accepts responses without nonce

(...)

[James]

So the proposed server-generated nonces are simply a mechanism to allow
Client Type I operate securely. I fully agree with you, that such a
client behaviour (accepting responses without nonce) seems to be
desirable from an operating point of view.

If a client Type I "accepts responses without nonce" (i.e. "B condition") then a nonce generated by the server is ignored by the client and thus does not help, and "do NOT allow Client Type I operate securely".

Denis