Subject: [pkix] OCSP 2560bis - responderID clarification

From: Simon Josefsson <[email-masked]>
Date: Thu, 02 Aug 2012 01:27:03 +0200

The semantics of the responderID field is something that may be useful
to clarify in an RFC 2560 document.  I brought this up earlier, but it
may have been forgotten in the flurry of other issues:

http://www.ietf.org/mail-archive/web/pkix/current/msg29802.html
http://www.ietf.org/mail-archive/web/pkix/current/msg29803.html

One good reason for not clarifying this would be if the intention is
fussy or people are implementing different approaches.  Does anyone know
if that is the case?

/Simon

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 02 Aug 2012 15:27:35 -0700

Simon,

I fully agree,
The spec ought to say something about the expected information if the Name
choice is chosen.

The ASN.1 structure is defined, but some wording about content would be
suitable.

I can't see however that anything but the subject name of the OCSP
responder (identical to the responder certificate) would go here.

/Stefan

On 12-08-01 4:27 PM, "Simon Josefsson" <[email-masked]> wrote:

>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 03 Aug 2012 10:45:42 +0200

> responder (identical to the responder certificate) would go here.

Thanks.  How about adding something like this to section 4.2.2.3?

  The purpose of the ResponderID information is to allow clients to find
  the certificate used to sign a signed OCSP response.  Therefor, the
  information MUST correspond to the certificate that was used to sign
  the response.

It should probably go early in the section, just after the first
bullet-point list.

I am not confident that this is non-controverisal, as I'm not an OCSP
expert.  I would appreciate if more people considered whether this text
makes sense or not.  I am hoping that the paragraph is trivial to
everyone experienced with OCSP.

When I wrote the OCSP support for GnuTLS I found this area to be
under-specified.  If there is any deployment out there which puts
something other than the OCSP responder signer cert identity in the
ResponderID field, I would have expected guidance from the document on
what purpose the field serves.

The introduction section also needs to be updated to describe this
change.  I would propose adding something like:

 o Section 4.2.2.3 clarify that the ResponderID field corresponds to the
   OCSP Responder signer certificate.

Btw, I noticed a typo in the document:

OLD:
      o  Section 4.1.1 specifies the ASN.1 syntax for the nonce
NEW:
      o  Section 4.4.1 specifies the ASN.1 syntax for the nonce

If the XML is available in a respository somewhere, I could send you a
patch. :-)

Cheers,
/Simon

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 03 Aug 2012 11:32:53 -0700

Thanks Simon.

I'll include your updates. They seem fine with me.

No I don't have an XML. I use the Awesome NroffEdit tool :)

/Stefan