Subject: RE: DISCUSS: MUST reject in OCSPv1

From: "Ryan M. Hurst" <[email-masked]>
Date: Thu, 27 Nov 2003 18:04:13 -0800

cil

________________________________

From: [email-masked] on behalf of Marc Branchaud
Sent: Thu 11/27/2003 4:23 PM
To: [email-masked]
Subject: Re: DISCUSS: MUST reject in OCSPv1

That's all fine.  Really!

But why would the client not care if the nonce is echoed in the response?

The client should only ask for a fresh response if it really wants one.
To make frivolous requests for freshness would unnecessarily tax a
server that actually cares and tries to fulfill the requests.

[rmh] The question is does it want it or does it need it, in the case I gave the bookstore.com server would be happy with any response thats not expired; maybe the pre-production responder already has one that meets that criteria.

In the end, making the requirement anything less that "MUST reject" will
lead to servers simply ignoring the nonce extension altogether.

                M.

Florian Oelmaier wrote:
> Your argument is "nonces are only for replay protection". Thats true.
>
> Now lets discuss WHY a client wants to get replay protection. Seeing
> that we have the three times in the response with a clear semantic, the
> client is not harmed by a replay. So why should a client include a nonce
> into the request?
>
> There are different reasons for that, but the main reason is: the client
> wants a "fresh" response. Following that path Ryans arguments apply as
> he presented it in his previous replies. A client will include a nonce
> into the request to ask for a "fresh" response. If the client does not
> need a fresh response, then replaying is not a problem (then it is a
> feature called "caching").
>
> So if a responder gets a request with a nonce, it not only means "the
> client wants replay protection" - it also means "the client would like
> to get a fresh response". Because otherwise replay attacks would not
> matter.
>

---

From: Marc Branchaud <[email-masked]>
Date: Fri, 28 Nov 2003 09:40:06 -0800

Ryan M. Hurst wrote:
> 
> [rmh] The question is does it want it or does it need it, in the case I 
> gave the bookstore.com server would be happy with any response thats not 
> expired; maybe the pre-production responder already has one that meets 
> that criteria.

If the client doesn't need it, then it shouldn't use it.  To do 
otherwise makes for a bad protocol.

		M.