Subject: RE: [OCSP] are several requests for different CAs at once valid ?

From: [email-masked] (Peter Gutmann)
Date: Fri, 12 Sep 2003 15:00:30 +1200

"Ryan M. Hurst" <[email-masked]> writes:

>Requests do not contain a nonce, and a nonce's in the Responses are ignored.

Done in order to make replay attacks feasible?

Peter.

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Thu, 11 Sep 2003 20:57:58 -0700

Done in order to support pre-produced OCSP responses, our goal is to create solution capable of being deployed in distributed enviroments and in volumes in-practical to support dynamic signing. This is also why we default to GET, most HTTP proxies do not support caching of POSTs.

Ryan

From: Peter Gutmann
Sent: Thu 9/11/2003 8:00 PM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Peter.

---

From: Vadim Fedukovich <[email-masked]>
Date: Fri, 12 Sep 2003 15:33:08 +0300

> Done in order to support pre-produced OCSP responses, our goal is to create solution capable of being deployed in distributed enviroments and in volumes in-practical to support dynamic signing. Thi…

Dear Ryan,

what exactly is dynamic signing?

Vadim

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Fri, 12 Sep 2003 07:47:21 -0700

Vadim - Traditionally OCSP responders generate and sign responses on-demand (dynamically), this requires the responders to scale their infrastructure to handle very high peak volumes. Since many clients, ours included cache responses this results in most traffic happening at a fixed time the use of  pre-produced (or batch generated responses) allows for a number of intersting deployment scenarios leveraging proxies which enable high volume deployments of OCSP.

To be clear our client doesnt require this type of deployment, we just implemented it in such a way to allow for it as our goal is to be able to support internet scale revocation checking with our customers.

Ryan

From: Vadim Fedukovich
Sent: Fri 9/12/2003 5:33 AM
To: [email-masked]
Subject: Re: [OCSP] are several requests for different CAs at once valid ?

Dear Ryan,

Vadim

---

From: Vadim Fedukovich <[email-masked]>
Date: Fri, 12 Sep 2003 18:15:46 +0300

Dear Ryan,

should one read it as a definition:
dynamic signing is a set of pre-produced (or batch-generated) responses?

What is expected timeframe between a revocation request submitted
by a private key owner and availability of an updated OCSP response?

How a client can be convinced the server supplied a fresh enough response?
..the reason for a client to check the current status is to get some profs
instead of just trusting the server

thank you,
Vadim