RE: DISCUSS: MUST reject in OCSPv1

["Michael Myers" <mmyers@xxxxxxxxx>]

> -----Original Message-----
> From: Tom Gindin
> Sent: Friday, December 12, 2003 3:58 PM
>
> Mike:
>
> While we're on this subject, do we need to
> include that a client "MUST" reject a response
> containing a nonce which does not match the
> request?

Tom,

We may be saying the same thing:

if( req->sent_nonce != rsp->rcvd_nonce )
   fail( BADNONCE )
else
   proceed( rsp );

The more interesting question along these lines is the one
regarding Florian's server-unilateral nonces.  I.e. a client
receives a nonce extension in the response even though the
client didn't provide a nonce extension in its request.  While
I'm not yet convinced of this practice's security value, I see
no reason to preclude it in our forthcoming clarification
regarding nonces.

Mike