Subject: RE: POLL: Use of nonces in OCSP

From: "Ryan M. Hurst" <[email-masked]>
Date: Thu, 25 Sep 2003 10:38:42 -0700

Yes

I would also like to see text indicating the intent of leaving a nonce
out of the request, namely its OK for a server to provide a pre-produced
response.

Ryan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Michael Myers
Sent: Wednesday, September 24, 2003 7:38 AM
To: [email-masked]
Cc: Stephen Kent; Ambarish Malpani
Subject: POLL: Use of nonces in OCSP

All,

Recent list traffic indicates there might be some confusion out
there regarding the use of nonces in OCSP.  This is
understandable since RFC 2560 is regrettably silent on the
point.  It seems that most folks correctly inferred our original
intent but absent normative language there's a possibility that
some may not.

After some discussion with the Chairs and the AD, we will take
action to clarify our original intent in one fashion or another
but first need to poll IMPLEMENTORS to determine how many, if
any, implementations of OCSP would break as a consequence of the
following normative language:

    "Clients that elect to include a request nonce
     SHALL reject responses that fail to include
     the client's nonce from the associated request."

    "Correspondingly, upon receipt of a request
     containing a nonce, a responder SHALL include
     the value of such nonce in the production of
     the associated response."

IMPLEMENTORS ONLY, please, and just yes/no or equivalent.

Mike

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 25 Sep 2003 10:53:03 -0700

Ryan,

I take that as "yes, that's what our code does."

Let's identify another thread to address pre-produced responses
and so keep the POLL: thread focused on gathering break/no-break
responses.  Thanks.

Mike

> From: Ryan M. Hurst [mailto:[email-masked]]
> Sent: Thursday, September 25, 2003 10:39 AM
> To: Michael Myers; [email-masked]
> Subject: RE: POLL: Use of nonces in OCSP
>
>
> Yes
>