RE: DISCUSSION: Nonce-specific error code for OCSP

["Michael Myers" <mmyers@xxxxxxxxx>]

It seems to me that an extended response is no improvement upon
a plain response when applied to replay detection.  It too can
be replayed because there is no dynamic binding between request
and response.  That's what the nonce extension was defined to
enable: client-side elimination of replay risks via dynamic
binding.

Further, the requestor which sent a nonce and received a
non-nonced response can today infer "responder does not support
nonces."  Something like 11 of 12 client side implementors claim
ability to detect such.  Inclusion of an extension which in
effect asserts that "I as responder give myself permission to
disregard your nonce" does nothing to improve upon that.

Mike