Subject: RE: POLL: Use of nonces in OCSP

From: "Wertz, Eric" <[email-masked]>
Date: Wed, 24 Sep 2003 14:58:41 -0700

Neither RSA Cert-C or Cert-J would be affected/broken by this clarification
to the nonce-handling text.

-e

---

From: "Miguel Rodriguez" <[email-masked]>
Date: Thu, 25 Sep 2003 10:00:26 -0500

After reviewing carefully your statement, my definitive answer is NO,
our implementation will not break.

Miguel A Rodriguez
SeguriDATA
Mexico

> -----Original Message-----
> From: Michael Myers [mailto:[email-masked]]
> Sent: Wednesday, September 24, 2003 2:13 PM
> To: Miguel Rodriguez
> Subject: RE: POLL: Use of nonces in OCSP
> 
> Miguel,
> 
> May I call you to understand why?  Else you can call me at
> +1-602-739-7744.
> 
> Michael Myers
> 
> > -----Original Message-----
> > From: Miguel Rodriguez [mailto:[email-masked]]
> > Sent: Wednesday, September 24, 2003 12:02 PM
> > To: 'Michael Myers'
> > Subject: RE: POLL: Use of nonces in OCSP
> >
> >
> > Yes
> >
> > Miguel A Rodriguez
> > SeguriDATA
> > Mexico
> >
> > > -----Original Message-----
> > > From: [email-masked]
> > [mailto:[email-masked]]
> > > On Behalf Of Michael Myers
> > > Sent: Wednesday, September 24, 2003 9:38 AM
> > > To: [email-masked]
> > > Cc: Stephen Kent; Ambarish Malpani
> > > Subject: POLL: Use of nonces in OCSP
> > >
> > >
> > > All,
> > >
> > > Recent list traffic indicates there might be some
> > confusion out
> > > there regarding the use of nonces in OCSP.  This is
> > > understandable since RFC 2560 is regrettably silent on the
> > > point.  It seems that most folks correctly inferred
> > our original
> > > intent but absent normative language there's a
> > possibility that
> > > some may not.
> > >
> > > After some discussion with the Chairs and the AD,
> > we will take
> > > action to clarify our original intent in one
> > fashion or another
> > > but first need to poll IMPLEMENTORS to determine
> > how many, if
> > > any, implementations of OCSP would break as a
> > consequence of the
> > > following normative language:
> > >
> > >     "Clients that elect to include a request nonce
> > >      SHALL reject responses that fail to include
> > >      the client's nonce from the associated request."
> > >
> > >     "Correspondingly, upon receipt of a request
> > >      containing a nonce, a responder SHALL include
> > >      the value of such nonce in the production of
> > >      the associated response."
> > >
> > > IMPLEMENTORS ONLY, please, and just yes/no or equivalent.
> > >
> > > Mike
> >
> >
> >
> >
>

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Thu, 25 Sep 2003 10:50:51 -0700

Yes, that is what I meant :)

-----Original Message-----
From: Michael Myers [mailto:[email-masked]] 
Sent: Thursday, September 25, 2003 10:53 AM
To: Ryan M. Hurst; [email-masked]
Cc: Stephen Kent; Ambarish Malpani
Subject: RE: POLL: Use of nonces in OCSP

Ryan,

I take that as "yes, that's what our code does."

Let's identify another thread to address pre-produced responses
and so keep the POLL: thread focused on gathering break/no-break
responses.  Thanks.

Mike

> From: Ryan M. Hurst [mailto:[email-masked]]
> Sent: Thursday, September 25, 2003 10:39 AM
> To: Michael Myers; [email-masked]
> I would also like to see text indicating the intent
> of leaving a nonce
> out of the request, namely its OK for a server to
> provide a pre-produced
> response.
>
> Ryan
>
> Sent: Wednesday, September 24, 2003 7:38 AM
> To: [email-masked]
> After some discussion with the Chairs and the AD, we will take
> action to clarify our original intent in one fashion
> or another
> but first need to poll IMPLEMENTORS to determine how many, if

---

From: "Deacon, Alex" <[email-masked]>
Date: Thu, 25 Sep 2003 17:12:48 -0700

Hi Mike,

Although this new text would not break the existing VeriSign OCSP code base,
it will break the (soon to be deployed) next generation of our OCSP
services.  These services are designed to serve PKI's with a high volume of
RP's (such as TLS server and code signing CA's) and rely on response
pre-production, distribution and caching through out the network.  

In such a deployment it is not possible for a responder to include a nonce
in the response.

Regards,
Alex

> Recent list traffic indicates there might be some confusion out
> point.  It seems that most folks correctly inferred our original
> intent but absent normative language there's a possibility that
> some may not.
> 
> action to clarify our original intent in one fashion or another
> any, implementations of OCSP would break as a consequence of the

---

From: Russ Housley <[email-masked]>
Date: Fri, 26 Sep 2003 12:30:55 -0400

Alex:

To support such an environment, the client should not include a nonce in 
the request.  Do you have control over the clients?  If so, then the change 
will not cause you a problem.

Russ