Subject: [TLS] Upload of draft-greevenbosch-tls-ocsp-lite-00

From: Bert Greevenbosch <[email-masked]>
Date: Mon, 31 Dec 2012 09:16:50 +0000

Dear all,

I have uploaded a draft, which provides a revocation verification mechanism for raw public keys. The draft is available under the following link:
http://www.ietf.org/internet-drafts/draft-greevenbosch-tls-ocsp-lite-00.txt

The draft defines an OCSP-lite responder, which is heavily inspired by the OCSP responder from RFC 2560. However, the original OCSP responder was designed for X.509 certificates and certificate chains, whereas the OCSP-lite responder verifies a single raw public key at a time.

The idea is simple: when an entity receives a raw public key, it sends the associated ID to the OCSP-lite responder, whereupon the OCSP-lite responder returns a value "GOOD", "REVOKED", "EXPIRED" or "UNKNOWN". Digital signatures and nonces make sure the responses are authenticated and fresh. The ID is defined as the hash over the public key, providing a secure binding between the ID and the public key.

It is the target to keep the OCSP-lite responder protocol as lightweight as possible, such that it can be used by constrained devices that support the raw public key.

I look forward to your comments and suggestions!

Best regards,
Bert