Subject: Re: What happened to the OCSPv2 draft?

From: [email-masked] (Peter Gutmann)
Date: Mon, 16 Sep 2002 14:03:43 +1200 (NZST)

Denis Pinkas <[email-masked]> writes:

>OCSP v2 should NOT expand its possibilities beyond certificate revocation
>checking and certainly should NOT try to expand its capabilities to cover
>certificate validation.
>
>To be more precise, I do not care about the expired OCSP v2 draft, but I
>care about fixing RFC 2560, while sticking to its original functionality:
>individual certificate revocation information status check.
>
>Having said that, we should correct the major problem that exists in
>RFC 2560, which is how the certificate can be defined.
>
>[...]

I agree with absolutely everything Denis has said.

[Pause.  Rereads post two more times]

Ah, I finally found something to disagree with: The tag for the OCTET STRING
is redundant :-).

All OCSP really needs is a more usable way to identify certs, and the CRL
locator would be useful too.  Both of these are trivial additions to OCSP
which could be easily added to 2560-bis, and don't require any v2, which was
adding all sorts of other stuff to the extent where it was almost a different
protocol.  If there's total opposition to making this tiny change to 2560-
bis, and since no-one has spoken out for the current v2 draft, I'll do the new
v2 draft myself (or do you want to do it Denis?).  It's only going to be a
page or so of text by the looks of it.

Peter.

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 17 Sep 2002 09:33:31 +0200

Peter,

> I agree with absolutely everything Denis has said.

Fine.
 
> locator would be useful too.  

Yes.

> Both of these are trivial additions to OCSP  which could be easily added 
> to 2560-bis, and don't require any v2, which was adding all sorts of other 
> stuff to the extent where it was almost a different protocol.  

Yes.

> If there's total opposition to making this tiny change to 2560-

Before doing it, it would be nice to agree on the additions to OCSP allowing 
more usable way to identify certs.

See my detailed response to Ambarish on that topic.

Then if we all agree, I would rather prefer that we first propose the role
of editor to one of the original authors. If no one volonteers, then your
proposal of being the lead editor should certainly be considered.

Regards,

Denis