Subject: RE: DPD/DPV reqmts: hash of the request

From: "Housley, Russ" <[email-masked]>
Date: Mon, 4 Mar 2002 15:51:09 -0500

Mike:

They are not in the document, bu I recall some email requesting an
indentifier in the request that could be paired with the same identifier in
the response.

Russ

-----Original Message-----
From: Michael Myers
To: Housley, Russ; [email-masked]
Cc: [email-masked]
Sent: 3/4/02 2:35 PM
Subject: RE: DPD/DPV reqmts: hash of the request 

Russ,

What nonce handling requirements?

Mike

> -----Original Message-----
> From: Housley, Russ [mailto:[email-masked]]
> Sent: Monday, March 04, 2002 11:18 AM
> To: 'Michael Myers '; [email-masked] '
> Cc: [email-masked] '
> Subject: RE: DPD/DPV reqmts: hash of the request 
> 
> 
> Mike:
> 
> I think that the nonce handling requirements already 
> prevent this type of
> processing.
> 
> Russ

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 4 Mar 2002 16:00:19 -0800

Russ,

Searched the list but couldn't find the reference although I do
recall the same.

However, my point is that both RFC2560/OCSP and the SCVP I-D
enable nonces but don't mandate their use.  While I can't speak
directly to the SCVP I-D, 2560's cert status envelope makes this
practice optional in order to enable the pre-production of
responses while yet enabling more rigorous environments the
ability to force a direct binding between request and response.

A MUST requirement forcing a one-to-one binding between a DPV
response and its corresponding request breaks this allowance.  I
recommend a SHOULD.

Mike

> They are not in the document, but I recall some email
> requesting an identifier in the request that could
> be paired with the same identifier in the response.
>
> Russ
>
>
> > prevent this type of processing.

---

From: "Housley, Russ" <[email-masked]>
Date: Tue, 05 Mar 2002 08:54:24 -0500

Mike:

I understand your points.

What, if any, language would you like to see added to the document?

Russ