Subject: RE: OCSPv1 and nonces (RE: draft meeting minutes)

From: "Florian Oelmaier" <[email-masked]>
Date: 20 Nov 2003 18:20:30 -0000

> The version number will be updated since legacy clients that are
> merrily going along parsing against v == 0 will very likely
> choke when they see bits on the wire they weren't expecting.

Seeing that the alternative proposal is a "responseExtension", clients will NOT choke. OpenValidation.org adds such an extension to every OCSP-Response for more than 6 months now. During this time we had thousands of requests sent by more than 45 clients (http://www.openvalidation.org/en/kontakt/ocsp_stats.html#browrep). 

The extenstion system in OCSP works and is fully compatible. No client will "choke". 

If you push the MUST reject "solution" through, I expect it to be the other way round: you may change the spec, but a lot of clients and servers will simply not adhere to it, as it is not compatible to some use-cases out there.

> Meanwhile, 2560 is going from Proposed to Draft.  We are allowed
> to and already have performed minor amendments.  The "MUST
> reject" clarification will be another.

Seeing the text size it will be a "minor" amendment, seeing the implications it is a HUGE change.

As this will change the specification very significantly, I wonder if the IESG will recommend that the revision be treated as a new document, reentering the standards track at the beginning.

-- 
Florian Oelmaier
SyTrust

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 20 Nov 2003 12:29:40 -0800

Florian,

I'm not surprised at your result.  Server-unilateral nonces are
arguably consistent with standing 2560 syntax. However, this
practice is not identified in the standard.  More importantly,
is it not responsive to client-driven prevention of replay
attacks.

As to the likelihood of clarifying 2560 as it goes from Proposed
to Draft with the guidance provided us by our Area Director, see
RFC 2026.  The "MUST reject" clarification is amply supported by
the breakage poll.

If you disagree with Russ's guidance, take it up with Steve or
Russ.

Mike