Subject: RE: PKINIT issues, proposals

From: "Eric Rosenfeld" <[email-masked]>
Date: Wed, 14 Jul 2004 16:12:52 -0600

Martin,

The only issue here is whether to include OCSP tunneling in PKINIT. The
authors have proposed that OCSP tunneling not be included in PKINIT.
Instead, OCSP tunneling can be addressed in a separate draft. Microsoft,
which originally requested OCSP tunneling and has not stated that they
must have a last-call PKINIT by October 2004, has agreed to pursue it in
a separate draft if the WG agrees. I agree that this is the best course
of action.

-Eric

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Wednesday, July 14, 2004 3:13 PM
To: Brian Tung
Cc: [email-masked]
Subject: Re: PKINIT issues, proposals

Hi,

Brian Tung wrote:
> 
> 1.  We propose to withdraw the OCSP mechanism from PKINIT.  Although
it
>     has potential benefit, it is not integral to the operation of
PKINIT.
>     It also represents an additional point of potential delay for
>     advancement.

Now THAT confuses me!

I thought we had consensus that OCSP revocation checking was a good
and valuable thing to have and that having the KDC include a
cached OCSP response along with his own certificate would be
a much simpler and much more robust approach.

Why do you suddenly want to drop OCSP revocation checking altogether?

It makes me feel that someone already had OCSP tunneling implemented
and would have been happy to get it rubber stamped the existing
implementation, but our much better suited approach would mean some
amount of work for everybody (and a level playing field).

I'm really puzzled why a feature that seemed to be very important
has lost all interest AFTER a significantly less complex solution
has been proposed.

What is the problem in defining where the cached OCSP response
should be put in the KDC handshake reply?

-Martin

---

From: Jeffrey Altman <[email-masked]>
Date: Wed, 14 Jul 2004 18:18:58 -0400

I believe that Nico, Martin, Sam, and I agree that tunneling is not the 
correct approach
but that inclusion of OCSP responses in the KDC response (and perhaps 
the client request)
is the appropriate way to go.

Larry has promised me that he would have text describing Microsoft's 
OCSP proposal
submitted to the working group within the next 24 hours.  I really hope 
it will be sooner
rather than later.

- Jeff