Subject: Re: OCSPv1 and nonces (RE: draft meeting minutes)

From: Russ Housley <[email-masked]>
Date: Fri, 21 Nov 2003 17:31:08 -0500

Marc:

I considered this approach too.  And right now, it may be the best way 
forward, but it does still have an impact on the specification.

Section 4.1.2  of RFC 2560 says:

    Support for any specific extension is OPTIONAL. The critical flag
    SHOULD NOT be set for any of them.

Russ

At 10:43 AM 11/21/2003 -0800, Marc Branchaud wrote:

>It seems to me that we could simply allow clients to make the nonce 
>extension critical.
>
>
>If the client makes nonce critical, it is essentially telling the server 
>that it will not accept a nonceless (cached) response.
>
>
>OTOH, if the client is willing to accept nonceless responses, it simply 
>makes the request's nonce extension non-critical.
>
>
>Responders that don't support nonces (e.g. caching or pre-generating 
>responders) have to return an error (internalError?) if the request has a 
>critical nonce extension.
>
>
>This approach doesn't add any new MUSTs or SHOULDs.  It just gives clients 
>the ability to ensure that their local policies are followed.
>
>
>                 M.
>
>
> >
>List-ID: <ietf-pkix.imc.org>
>List-Unsubscribe: <mailto:[email-masked]?body=unsubscribe>
>X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on woodstock
>X-Spam-Status: No, hits=0.0 required=8.0 tests=none autolearn=no version=2.60
>X-Spam-Level:
>
><file://c:\program files\qualcomm\eudora\attach\Re OCSPv1 and nonces (RE 
>draf.ems <0265.0002>>Re OCSPv1 and nonces (RE draf.ems

---

From: Marc Branchaud <[email-masked]>
Date: Fri, 21 Nov 2003 14:41:00 -0800

>    SHOULD NOT be set for any of them.

I think that allowing critical nonces in requests is perfectly 
compatible with that SHOULD NOT statement.

RFC2119 sez:

4. SHOULD NOT   This phrase, or the phrase "NOT RECOMMENDED" mean that
    there may exist valid reasons in particular circumstances when the
    particular behavior is acceptable or even useful, but the full
    implications should be understood and the case carefully weighed
    before implementing any behavior described with this label.

I think that we have a valid reason to use the critical flag here.

		M.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 21 Nov 2003 22:39:23 -0500

Russ:

I also think Marc's proposal may be the best way forward given the way the
RFC is written.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Marc Branchaud
Sent: Friday, November 21, 2003 5:41 PM
To: Russ Housley
Cc: [email-masked]
Subject: Re: OCSPv1 and nonces (RE: draft meeting minutes)

RFC2119 sez:

		M.