Subject: Cached OCSP responses vs. single entry CRLs

From: "Carl Wallace" <[email-masked]>
Date: Fri, 5 Dec 2003 16:09:01 -0500

Why use OCSP to convey pre-produced revocation information in the way that's
being discussed?  Why not use single entry CRLs?  The functionality is
similar and they could be propagated using existing technology (e.g.
directories, 3280 compliant path processing clients, etc.).

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 5 Dec 2003 15:28:11 -0700

> From: Carl Wallace
> Sent: Friday, December 05, 2003 2:09 PM
>
> Why use OCSP to convey pre-produced revocation
> information in the way that's being discussed?
> Why not use single entry CRLs?  The functionality
> is similar and they could be propagated using
> existing  technology (e.g. directories, 3280
> compliant path processing clients, etc.)

Carl,

Funny you should mention that.  The utility of CRL-based
approaches to the needs addressed by OCSP were amply debated in
the I-D phase of OCSP's development, principally between myself
and Carlisle Adams.  The turning point came when that dialog
yielded the notion of nonces in OCSP.

Mike