Subject: RE: [OCSP] are several requests for different CAs at once valid ?

From: [email-masked] (Peter Gutmann)
Date: Tue, 16 Sep 2003 03:29:42 +1200

"Ryan M. Hurst" <[email-masked]> writes:

>Now your just being silly Peter, using pre-produced OCSP responses is no
>worse that using CRLs and it is a cocept explicitly supported by the RFC for
>the very reasons we implemented it that way.

I agree that technically it's no worse than a CRL.  However, the "O" in "OCSP"
stands for "Online", not "Offline", which is what the nonceless responder
design is doing to it.  The fact that the name of the protocol is "Online
Certificate Status Protocol" will no doubt lead some poor misguided users to
believe that they're actually getting some sort of live, online check, not
just a query of last week's CRL data.

Maybe the RFC title needs to be changed.  Or there could be two variants, the
"Offline CRL Query Protocol" (OCQP) and OCSP.  The problem at the moment is
that users have no idea what they're getting, presumably all are expecting
OCSP while many are only getting OCQP.  This is at best misleading, and at
worst deceptive if someone's truly relying on it for real, live cert status
info.

Peter.

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Mon, 15 Sep 2003 08:49:21 -0700

In-line

From: Peter Gutmann
Sent: Mon 9/15/2003 8:29 AM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

[rmh] I actualy think its better than CRLs, with the use of OCSP it become possible to do revocation checking by default on 56k connections for things like SSL, its also possible to make more frequent updates, etc. As for your definition your quibling on symmantics, The Online in OCSP does not necessarily mean the response was dynamically generated, afterall its a protocol that will only work when its online. Also the fact that responses are pre-produced does not mean they were issued off of stale data, it simply means that caching of responses is possible. 
[rmh] More sillyness, The response has a thisUpdate, nextUpdate and ProducedAt; these values are adequare for communicating the freshness necessary to comminicate publication policy to the user.
Peter.