Re: POLL: Nonce-specific error code for OCSP

["Florian Oelmaier" <oelmaier@xxxxxxxxxxx>]

> Should we standardize an OCSP *V1* error code that enables a
> responder to indicate its inability to respond to nonced
> requests?
> 
> Please respond with either YES or NO.

NO

Rationale: 
My first idea was to say: if it is OPTIONAL for the responder to use that error code it is ok. But in fact even the OPTIONAL inclusion harms the security of the protocol, as an attacker can fool clients into believing a particular OCSP-Responder would not support nonces, when in fact it does.

My conclusion: Dont include such an error code, due to security reasons. If other reasons (yet unknown to me) overrule these concerns make the use of this error code OPTIONAL for responders to allow compatibility with existing installations and not to harm the functionality of the protocol.

-- 
Florian Oelmaier
SyTrust