RE: DISCUSS: MUST reject in OCSPv1

["Florian Oelmaier" <oelmaier@xxxxxxxxxxx>]

> I like the elegance of Russ and Florian's ideas for securely signalling 
> that a server doesn't support nonces by using a special value for the 
> nonce in replies.  This seems like the "right" place to put this message 
> to the client.

Just for the record: I think you are referring to our server-generated nonces when you talk about "Florian's idea". And while Russel is signalling "NonceUnsupported" with a special nonce-value, we are singalling "NonceSupported" with the inclusion of a nonce into every request (mirrored from the request or server-generated). Thus we are not subject to the attack you mention, as this does not need any additional code in any existing client.

Russ proposal is a change in the protocol. Thus we need to update all the clients and servers out there. Seeing that the proposed change is needed and recognizing it as a good solution, I would accept this. 

-- 
Florian Oelmaier
SyTrust