RE: Cached OCSP responses vs. single entry CRLs

["Carl Wallace" <cwallace@xxxxxxxxxxxx>]

> From: David Engberg [mailto:dengberg@xxxxxxxxxxxxxx] 
> Subject: Re: Cached OCSP responses vs. single entry CRLs
> 
> In terms of how an implementation produces and distributes 
> pre-generated OCSP responses, there are a large number of mechanisms to do
this 
> (pushing, pulling, rsync, fedex CD-ROMs, etc.).  None of these are 
> visible to the relying parties, so I don't think there needs 
> to be any mandatory implementation in an RFC.
> 

That it is not visible to relying parties does not necessarily remove a need
for standardization.  It's easy to see where non-standardization of the
means of replication would lock folks into a particular vendor's solution.
For what it's worth, I'm not lobbying for additional standardization efforts
in that area.  The point is that there exist today ample standards to deploy
a solution that is more or less functionally equivalent to "cached OCSP" or
"nonce not supported OCSP".