Subject: OCSP signed requests

From: "Miguel Rodriguez" <[email-masked]>
Date: Thu, 9 Jan 2003 17:34:18 -0600

What is the prescribed (or most common) behavior of an OCSP responder
when receiving a signed request? Should the signature be ignored if it
is not required? 
 
Thanks,
 
Miguel A. Rodriguez
Software Engineer
SeguriDATA

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 9 Jan 2003 20:21:23 -0800

Miguel,

Signed OCSP requests enable audit trails and authenticated
service access.  Implementors should produce this capability;
deployers decide on its use.

Mike

-----Original Message-----
From:    Miguel Rodriguez
Sent:    Thursday, January 09, 2003 3:34 PM
Subject: OCSP signed requests

What is the prescribed (or most common) behavior of an OCSP
responder when receiving a signed request? Should the signature
be ignored if it is not required?

Thanks,

Miguel A. Rodriguez
Software Engineer
SeguriDATA

---

From: "Ambarish Malpani" <[email-masked]>
Date: Thu, 9 Jan 2003 21:41:19 -0800

Hi Miguel,
    If a responder doesn't require signed requests, it is free to ignore the
signature
completely and not validate it at all.

Hope this helps,
Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani                                          650.759.9045
Malpani Consulting Services
[email-masked]

  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On
Behalf Of Miguel Rodriguez
  Sent: Thursday, January 09, 2003 3:34 PM
  To: [email-masked]
  Subject: OCSP signed requests

  What is the prescribed (or most common) behavior of an OCSP responder when
receiving a signed request? Should the signature be ignored if it is not
required?

  Thanks,

  Miguel A. Rodriguez

  Software Engineer

  SeguriDATA