Subject: Signature in OCSP Request

From: "Yasir Khan" <[email-masked]>
Date: Mon, 17 May 2004 19:00:53 +0500

Hello

I have a question about the signature field in OCSP request. What exactly should it contain and what 
algorithms can be used for OCSP request signing? 

When i create a signature using MS CAPI, OCSP reponders are unable to verify the signatures whereas we
can verify it using CAPI. What data do we set in signature field exactly?

Regards,

Yasir

---

From: "Miguel Rodriguez" <[email-masked]>
Date: Mon, 17 May 2004 19:41:14 -0500

You may need to reverse the signature so it can be verified by the OCSP
server. The signature should be computed over the tbsRequest structure.
Regarding the algorithms RFC 2560 is nto specific when it comes to
signed requests, we need further clarification of this point.
 
Miguel A Rodriguez
SeguriData
Mexico

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Yasir Khan
Sent: Monday, May 17, 2004 9:01 AM
To: [email-masked]
Cc: [email-masked]
Subject: Signature in OCSP Request

Hello
 
I have a question about the signature field in OCSP request. What
exactly should it contain and what 
algorithms can be used for OCSP request signing? 
 
When i create a signature using MS CAPI, OCSP reponders are unable to
verify the signatures whereas we
can verify it using CAPI. What data do we set in signature field
exactly?
 
Regards,
 
Yasir

---

From: "Yasir Khan" <[email-masked]>
Date: Tue, 18 May 2004 15:07:53 +0500

MessageHello 

 I have attached the TBSData.req and signed requests after siging with CAPI and another toolkit. The file toolkitSignedRequest.req is a signed request file that was signed with a toolkit and OCSP responders accept the request. Wheras capiDirRequest.req is a file in which signatures have been calculated from CAPI and attached to request. But OCSP servers are unable to verify the signatures of the request. The last file capipkcsRequest.req is a request in which we made a PKCS#7 object of TBS Data using CAPI and obtained the signatures from PKCS#7 and attached to request.

We are unable to contrust a correct signed request using CAPI. The signatures in case of CAPI are different but we dont know why they are different?

Any help will be highly appreciated.

Regards 
  ----- Original Message ----- 
  From: Miguel Rodriguez 
  To: 'Yasir Khan' ; [email-masked] 
  Sent: Tuesday, May 18, 2004 5:41 AM
  Subject: RE: Signature in OCSP Request

  You may need to reverse the signature so it can be verified by the OCSP server. The signature should be computed over the tbsRequest structure. Regarding the algorithms RFC 2560 is nto specific when it comes to signed requests, we need further clarification of this point.

  Miguel A Rodriguez
  SeguriData
  Mexico
    -----Original Message-----
    From: [email-masked] [mailto:[email-masked]] On Behalf Of Yasir Khan
    Sent: Monday, May 17, 2004 9:01 AM
    To: [email-masked]
    Cc: [email-masked]
    Subject: Signature in OCSP Request

    Hello

    Regards,

    Yasir