Subject: RE: OCSP thoughts

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 2 Jul 2004 15:18:41 -0700

Jeffrey Altman wrote:

> I agree with this proposed optimization.

I have pointed out in several occasions that this is done in RFC3369bis.
 
Larry

________________________________

From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey
Altman
Sent: Friday, July 02, 2004 2:10 PM
To: Nicolas Williams
Cc: Martin Rex; [email-masked]
Subject: Re: OCSP thoughts

Nicolas Williams wrote:

		I'm NOT AT ALL against the client *processing* an OCSP
*response* to check
		the KDCs cert for revocation -- but it does not need to
perform the
		OCSP *request* through OCSP tunneling in PKINIT if the
KDC supplies
		it along with its own certificate.
		
		Your governmental customer should not have any problems
with this
		particular optimization.

	Fine with me, a very reasonable simplification.
	
	Thank you,
	
	Nico

I agree with this proposed optimization.

- Jeff

---

From: Jeffrey Altman <[email-masked]>
Date: Fri, 02 Jul 2004 17:16:54 -0700

>I have pointed out in several occasions that this is done in RFC3369bis.
Larry:

I disagree.   You have said that caching was done in RFC 3369bis which 
implied that
the client was performing an OCSP request.  I believe that the current 
proposal is for
the KDC to perform an OCSP request to validate itself and then include 
the OCSP
response (or a cached copy of the response) along with the TGT to the 
client.   The
client does not actually perform an OCSP request in this case. 

Martin, Nico: please correct me if I have misinterpretted the proposal.

- Jeff