Subject: Re: POLL: Use of nonces in OCSP

From: [email-masked] (Peter Gutmann)
Date: Thu, 25 Sep 2003 09:38:54 +1200

>    "Clients that elect to include a request nonce
>     SHALL reject responses that fail to include
>     the client's nonce from the associated request."
>
>    "Correspondingly, upon receipt of a request
>     containing a nonce, a responder SHALL include
>     the value of such nonce in the production of
>     the associated response."
>
>IMPLEMENTORS ONLY, please, and just yes/no or equivalent.

Yes (as in "Yes, that's what my code does").

Peter.

---

From: "Yasir Khan" <[email-masked]>
Date: Thu, 25 Sep 2003 21:05:28 +0500

NO, not broken:

Ascertia Revocation Provider (ARP) OCSP client
TrustFinder OCSP Server
SignEzee
PDF Signer

Regards,

Yasir Khan
Software Engineer
Ascertia Limited.
www.ascertia.com 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Michael Myers
Sent: 24 September 2003 15:38
To: [email-masked]
Cc: Stephen Kent; Ambarish Malpani
Subject: POLL: Use of nonces in OCSP

All,

Recent list traffic indicates there might be some confusion out
there regarding the use of nonces in OCSP.  This is
understandable since RFC 2560 is regrettably silent on the
point.  It seems that most folks correctly inferred our original
intent but absent normative language there's a possibility that
some may not.

After some discussion with the Chairs and the AD, we will take
action to clarify our original intent in one fashion or another
but first need to poll IMPLEMENTORS to determine how many, if
any, implementations of OCSP would break as a consequence of the
following normative language:

Mike