Subject: RE: DPD & DPV requirements - Let us Recurse

From: "Covey, Carlin" <[email-masked]>
Date: Thu, 4 Jan 2001 08:19:58 -0800

Steve Kent's DPD/DPV requirements, the SCVP proposal, and the OCSP DPD
proposal all permit OCSP responses
to be returned to the client as revocation status data.  Presumably in each
case this refers to OCSP v1 basic responses,
at least.  This is all well and good, but would it not be desirable to also
permit recursion in the DPD response?  That is, the DPD
response might include an embedded DPD response from another server.  Among
other benefits, this would preserve the 
timestamp (if any) on the embedded DPD response.
 
- Regards
  Carlin Covey
  Cylink Corp.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 5 Jan 2001 13:32:08 -0500

Carlin,

>Steve Kent's DPD/DPV requirements, the SCVP proposal, and the OCSP 
>DPD proposal all permit OCSP responses
>to be returned to the client as revocation status data.  Presumably 
>in each case this refers to OCSP v1 basic responses,
>at least.  This is all well and good, but would it not be desirable 
>to also permit recursion in the DPD response?  That is, the DPD
>response might include an embedded DPD response from another server. 
>Among other benefits, this would preserve the

Recursion has its attractions, but nested responses seem complex, 
syntactically if not semantically. Given the issues you raised about 
the 1 level of indirection posed by a DPD or DPV server interacting 
with an OCSP server, I am not yet comfortable with making life more 
complex in this regard.  First I think we need to solve the problem 
you identified, and then we can see if that solution will generalize 
to allow the recursion to work smoothly and in a readily 
understandable manner.

Steve