Subject: OCSP response in CMS

From: "Miguel Rodriguez" <[email-masked]>
Date: Mon, 5 May 2003 19:52:16 -0500

Hi! Can anyone say if there's a standard or guideline on how to store an
OCSP response in a CMS (pkcs #7), as it is for CRLs or time stamps?
 
Thanks,
 
Miguel A. Rodriguez
Software Engineer
SeguriDATA

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 07 May 2003 20:07:19 +0200

Miguel,

> OCSP response in a CMS (pkcs #7), as it is for CRLs or time stamps?

Take a look at RFC 3126:

4.2.2  Complete Revocation Refs Attribute Definition

    The Complete Revocation Refs attribute is an unsigned attribute.
    Only a single instance of this attribute must occur with an
    electronic signature.  It references the full set of the CRL or OCSP
    responses that have been used in the validation of the signer and CA
    certificates used in ES with Complete validation data.

    The following object identifier identifies the CompleteRevocationRefs
    attribute:

id-aa-ets-revocationRefs OBJECT IDENTIFIER ::= { iso(1) member-body(2)
     us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 22}

    The complete revocation refs attribute value has the ASN.1 syntax
    CompleteRevocationRefs.

    CompleteRevocationRefs ::=  SEQUENCE OF CrlOcspRef

Denis