[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: OCSP response pre-production


At 9:10 PM +0200 9/30/03, Florian Oelmaier wrote:
> >I think in the long run this will harm the security of the protocol. 
 >Major software vendors implementing OCSP-clients have to support
 >OCSP caching.

 Why? They could just support remembering one bit that says whether or
 not the server handles nonces. A setting of "don't send a nonce"
 could be cleared every 100 or so requests, leading to an increase of
 about 1% of the load for both the client and the server.


I know that this is possible. But I dont think many vendors will do it -
if you dont write it down into the RfC.

In your earlier message, you said what "major software vendors" had to do, and now you are saying what vendors won't do. I was pointing out that they didn't have to do what you said, and that they might do something else (that I think is sensible for both the vendor and the customer).

 So if you want such a thing to
happen, just state it in the RfC please.

Yes, it would be good if we put this in as a MAY-level suggestion.

--Paul Hoffman, Director
--Internet Mail Consortium