RE: OCSP response pre-production

["Michael Myers" <mmyers@xxxxxxxxx>]

All,

I was talking to some folks offlist on this subject yesterday
and thought I might ask if it's possible we could all get behind
the following simple fix.


SYNTAX:     Expand v1 OCSPResponseStatus syntax to
            include (7) noncesNotAccepted.


SEMANTICS:  Responders SHOULD respond back with the
            requestor's nonce but if can't then SHALL
            respond with an error message of the value
            noncesNotAccepted.

            Requestors SHALL reject signed responses
            that fail to incorporate a supplied nonce.

            Upon receipt of noncesNotRequired, requestors
            MAY retry the request without using a nonce.
            Requestors are STRONGLY ADVISED that doing
            so MAY subject them to additional risk.

Thus, essentially, requestors can set "nonce always" but if they
want to they can have that overridden on a per-request basis.

Opinions?

Mike