Subject: RE: OCSPv2: 02: certHash is not unique

From: Ambarish Malpani <[email-masked]>
Date: Thu, 29 Mar 2001 02:08:54 -0800

Mike,
    As I have said a few times before, I strongly oppose the
idea of using certHash as a method of identifying the certificate
whose status you want to check. It forces the responder to have
access to information that is not normally available to most
responders - even those run by most CAs (AFAIK).

I don't know that we are saving all that many bytes by using
certHash as opposed to certID.

It just doesn't make sense to me that we provide 5-6 different
ways of identifying a certificate in OCSP - I think it will
lead to a lot more interop problems, without buying us any
additional functionality.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Michael Myers [mailto:[email-masked]]
> Sent: Wednesday, March 28, 2001 5:59 PM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: RE: OCSPv2: 02: certHash is not unique
> 
> 
> Peter,
> 
> After some correspondence, I've come to the same conclusion 
> despite my prior
> proposal to Jim.  The high-level intent of the presence of an 
> option to
> hash/fingerprint the cert was to enable alignment to known 
> practices, not
> produce yet another variant.
> 
> Mike
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]
> > Sent: Thursday, March 29, 2001 9:47 AM
> > To: [email-masked]; [email-masked]
> > Subject: Re: OCSPv2: 02: certHash is not unique
> >
> >
> > "Carlin Covey" <[email-masked]> writes:
> >
> > >I am quite content with the suggestion that Jim made concerning
> > computing the
> > >certHash over only the signed portions of the certificate.
> >
> > I'm not.  I already have to create, track, store, and process a
> > whole pile of
> > certificate identifiers, and adding yet another wierdo 
> identifier which is
> > compatible with nothing else in existence to that pile when
> > there's no need for
> > it to be incompatible is something which I can really do without.
> >  The SHA-1
> > hash of the whole cert as "fingerprint" is pretty much
> > universally used and
> > accepted, unless there's a very strong reason not to use it I
> > don't see why we
> > need to invent yet another new identifier.
> >
> > Peter.
> >
> >
>

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 29 Mar 2001 18:12:02 +0200

Ambarish,

I second your position.

Denis