Re: [IETF-PKIX] OCSP using SSL/https

[Phillip M Hallam-Baker <pbaker@xxxxxxxxxxxx>]

>It seems that the main purpose of having signed responses in OCSP
>is to authenticate the responder.
>
>Would it be useful, and perhaps simplify things, to permit SSL/https
>to be used in the protocol instead of requiring signed responses over
>http?


Are we talking 'instead of' or 'optionally'?

The problem with using SSL is that the cache facility of HTTP
would be lost. Making the caching work really requires transaction
layer and not transport layer security.

I don't see a lot of value in pushing the public key work into
SSL except that it would avoid the need to sign each HTTP/1.1
reply in along sequence of requests. A more likely scenario
would be to want to use private key between two closely
coupled hosts.

Since we don't have a spec proposed for such a transport
I think that all we need at most doat this stage is put in some
wording to allow the possibility of relying on some other
proof of authenticity by prior agreement of both parties in
which case only the raw data need be sent.

            Phill