Subject: RE: DPD & DPV requirements - Recursion Issues

From: Michael Myers <[email-masked]>
Date: Mon, 15 Jan 2001 18:22:05 -0800

Steve,

> On Friday, January 12, 2001 3:19 PM you wrote:
> . . . 
> the question I asked was whether the OCSP response carried data that 
> tied it to a requestor, not a responder.

As Rick Salz noted, RFC 2560 enables such binding via the nonce mechanism.
Use of this mechanism is not however mandated.  Also, Rich Akney was a
strong advocate of the OPTIONAL requestorName syntax in an OCSP request.
The definition of the production of response signature in RFC 2560 does not
include the contents of the request in its hash.  We might wish to consider
amending this in the OCSPv2 I-D but it's not yet clear to me that we should
inhibit response transparency.  A relying party might very well wish to know
who is ultimately standing behind a certificate.

Mike

---

From: Stephen Kent <[email-masked]>
Date: Tue, 16 Jan 2001 15:39:46 -0500

Mike,

>who is ultimately standing behind a certificate.

The nonce is not a big concern, if it is just a way to match a 
request and a response, and can safely be ignored by the client, 
given suitable protection for the client/server query/response 
exchange. The requestorName is more of an issue, as it makes clear 
that the client or the server was not the requestor, in the case of 
nested or recursive server interactions.

I'm confused by your last sentence; presumably the OCSP responder 
stands behind the response, irrespective of the identity of the 
requestor, right?

Steve

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 16 Jan 2001 16:04:25 -0800

Steve,

An OCSP responder may aggregate data but choose not to aggregate risk. An
OCSP responder's response may (and I stress MAY) be nothing more than a
blind relay of an ultimate authority's assertion.  There is nothing in our
current protocol syntax or semantics that precludes such deployment of this
protocol.  Hence my assertion regarding transparency.

Mike

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Tuesday, January 16, 2001 12:40 PM
> To: Michael Myers
> Cc: PKIX-List
> Subject: RE: DPD & DPV requirements - Recursion Issues
>
>
> Mike,
>
> >
> >  > . . .