Subject: Response Signer Identity in OCSP

From: [email-masked] (Miguel Angel Rodriguez)
Date: Thu, 7 Feb 2002 17:54:15 -0600

Regarding section 3.2  Signed Response Acceptance Requirements in
OCSP-draft-03, in point number 3:

3. The identity of the signer matches the intended recipient of the
   request.

What does the client know about the identity of the responder? It knows    a
URL from the AuthorityInfoAccess in a given certifcate, and once it gets the
response it has the responder's certificate, a responderId, which may be a
name or the hash of its public key. But how can a client check that the
responder's identity matches the one of the intended recipient of the
request. Does it imply that the client has to validate the responder's
certificate? What is the purpose of the ResponderID field in the response?

Thanks,

Miguel A. Rodriguez
SeguriDATA
Mexico