[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: OCSP response pre-production




Michael Myers wrote:
This works for me, especially the part about getting definitive
on 2560 as it stands.  Ambarish?

I've been thinking about something more, I hope it doesn't reopen the whole can of worms.


What would you think if it'd also define an extension that the client can use in a request including a nonce, in order to indicate it will accept an answer without a nonce if it includes the pre-produced extension.

The server would be breaking RFC 2560 by sending back the pre-produced answer, but only with a client that has explicitly indicated it is expecting this behaviour.

This, if acceptable, would enable to fully avoid the round-trip with compatible servers.
Legacy servers would send back an error to this kind of request if they can not supply a nonce, which does not break the expected behaviour.


- define an extension that enable a responder to
assert the answer is a
cached answer and not an answer to a nonce-less request

I'll correct myself : "is a pre-produced answer and this server can not successfully answer requests requiring a nonce."