RE: OCSP response pre-production

["Miguel Rodriguez" <mars@xxxxxxxxxxxxxx>]

I agree with this too, the support for nonces should indicated in the
signed content, either as a special flag or as Julien suggested using
the nextUpdate field. I prefer any of these options over the definition
of a new (unsigned) error message.

Miguel A Rodriguez
SeguriDATA
Mexico

> -----Original Message-----
> From: owner-ietf-pkix@xxxxxxxxxxxx
[mailto:owner-ietf-pkix@xxxxxxxxxxxx]
> On Behalf Of Julien Stern
> Sent: Thursday, October 02, 2003 8:41 AM
> To: ietf-pkix@xxxxxxx
> Subject: Re: OCSP response pre-production
> 
> 
> I fully agree with this too. The server has to indicate whether it
> supports nonces or not INSIDE the signed content. Server generated
> nonces are a way, this extension is another (hmm, well, the equivalent
> of server generated nonces would be an ICanProvideANonceIfYouWish
> extension, but ...).
> On this other hand, I think that it is dangerous to indicate this fact
> as an _unsigned_ error, as this error reply could easily be faked by
an
> attacker, making him think a server does not support nonces while in
> fact it does.
> 
> --
> Julien