Re: DISCUSS: MUST reject in OCSPv1

[Marc Branchaud <marcnarc@xxxxxxxxxxxxxxx>]

Ryan M. Hurst wrote:
> I don't think its silly, the client is still protected from the replay 
> if the server responds to a nonced request with a un-nonced one as the 
> client can decide decide if he wanted the protection or needed it.

Why can't the client can decide this before making the request?

What does the client gain by making a nonced request but accepting a 
nonceless response?

> That may sound strange, but nonce has other implications that re-play 
> protection; it also implies freshness since pre-produced responses can 
> not have the right nonce in it.

If the group wishes to address the use of nonces for more than replay 
prevention, then I think the only option is to devise a new OCSPv2 spec.

		M.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature