Re: [IETF-PKIX] OCSP v CRLs over HTTP

[Carlisle Adams <carlisle.adams@xxxxxxxxxxx>]

>----------
>From:  Russ Housley[SMTP:housley@SPYRUS.COM]
>Sent:  Tuesday, December 02, 1997 11:43 AM
>To:    IETF-PKIX@LISTS.TANDEM.COM
>Subject:       Re: [IETF-PKIX] OCSP v CRLs over HTTP
>
>the digital signature on the CRL returned by HTTP or FTP provides teh
>authentication.  How is comperable authentication provided in the
>alternative?

In a similar way:  OCSP responses are either signed by the CA or signed
by the OCSP responder.

The latter is used if responders are separately certified, although my
understanding is that Mike was thinking of dropping this possibility
because of the added complexity of checking the revocation status of the
OCSP responder's certificate (which boils down to a second OCSP request
(i.e., one to the OCSP responder and one to the CA) thereby doubling
network traffic without reducing CA bandwidth).


--------------------------------------------
Carlisle Adams
Entrust Technologies
cadams@entrust.com
--------------------------------------------