Subject: RE: POLL: MUST reject in OCSPv1

From: "Manger, James H" <[email-masked]>
Date: Tue, 9 Dec 2003 08:56:11 +1000

AGREE

P.S. Terry,  #4 does not really require a server to recognize a particular extension.  Regardless of any extensions in a request, a caching server can simply always include the nonceUnsupported extension.
I would support SHOULD (or MUST) in #4.  Using SHOULD means existing caching servers are not made non-compliant, which (I think) was Ryan's main concern.

> 4. Conversely, if a server receives a nonced 
>    request but is unable to incorporate the 
>    nonce in its response, the server MUST 
>    include the nonceUnsupported extension.

---

From: Tom Gindin <[email-masked]>
Date: Fri, 12 Dec 2003 17:43:58 -0500

AGREE.  I don't care very much about whether point 4 becomes a 
SHOULD or not, as long as the client MUST reject a bad response.  Given 
that MUST in point 3, the difference between the nonceSupported and 
nonceUnsupported proposed extensions doesn't really matter.

                Tom Gindin

"Michael Myers" <[email-masked]>
Sent by: [email-masked]
12/08/2003 01:46 PM

        To:     <[email-masked]>
        cc:     "Carlisle Adams" <[email-masked]>
        Subject:        POLL:   MUST  reject in OCSPv1

All,

OK, so let's take a full-up poll on what we were looking at a
couple of weeks ago to see where we stand today.  Please respond
with either YES or NO.  Take discussions to the DISCUSS thread.

This approach preserves installed base functionality and yet
enables a clear and technically complete resolution of the
various perspectives.

To date, on the related DISCUSS thread, six have voiced
agreement to this path forward and two disagree.  From that
record:

AGREE
-----
David Engberg,      Corestreet
Florian Oelmaier,   Sytrust
Ambarish Malpani,   Cenzic
Marc Branchaud,     RSA
Miguel Rodriguez,   SeguriDATA
Frank Balluffi,     Deutsche Bank

DISAGREE
--------
Ryan Hurst,         Microsoft
Alex Deacon,        VeriSign

PROPOSED
--------
The proposed resolution is as follows:

1. Cycle v1 as Proposed Standard.  It was well
   on its way to Draft but we'll pull it back.

2. Define nonceUnsupported extension subject
   to the following semantics.

3. Clients that send a nonce:

   a. MUST reject a non-nonced response if
      that response includes either the value
      "good" or "revoked" AND it fails to
      include the nonceUnsupported extension;

   b. Else, if such response includes the
      nonceUnsupported extension, clients
      MAY accept the response subject to the
      advice in the Security Considerations
      section of this document.

We now have clearance to cycle v1 at Proposed so that's no
longer a predicate.

Thank you for your continued patience as we work towards
resolving this issue.

Mike