Subject: Re: OCSP thoughts

From: "Frank Balluffi" <[email-masked]>
Date: Thu, 1 Jul 2004 17:39:54 -0400

Jeffrey Altman said:

"I do not believe that OSCP responses can be cached."

Tumbleweed (formerly Valicert) and CoreStreet cache OCSP responses. See 
http://www.tumbleweed.com/products/validationauthority/evafeatures.html 
and http://www.corestreet.com/whitepapers/w03-07v1_nonce-sense.pdf.

Frank

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 2 Jul 2004 17:25:43 -0700

earlier, I wrote:
 
"the tunneling is designed to address a deficiency of the current
version of CMS, used by PKINIT."
 
if we just use 3369bis, the client should not need to request OCSP. 
 
larry

________________________________

From: Jeffrey Altman [mailto:[email-masked]] 
Sent: Friday, July 02, 2004 5:17 PM
To: Liqiang(Larry) Zhu
Cc: Nicolas Williams; Martin Rex; [email-masked]
Subject: Re: OCSP thoughts

Liqiang(Larry) Zhu wrote:

	Jeffrey Altman wrote:

		I agree with this proposed optimization.

	I have pointed out in several occasions that this is done in
RFC3369bis.
	 
	Larry

Larry:

I disagree.   You have said that caching was done in RFC 3369bis which
implied that 
the client was performing an OCSP request.  I believe that the current
proposal is for
the KDC to perform an OCSP request to validate itself and then include
the OCSP 
response (or a cached copy of the response) along with the TGT to the
client.   The
client does not actually perform an OCSP request in this case.  

Martin, Nico: please correct me if I have misinterpretted the proposal.

- Jeff