Subject: RE: OCSP, take three

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 15 Jul 2004 09:30:47 -0700

Martin Rex wrote:
>  and if the two requests are combined into a single ordered handshake
message then it would save a roundtrip 
> which I consider a valuable feature.

Yes, this is desirable. The text should be clear about this.

Larry

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Thursday, July 15, 2004 5:40 AM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: OCSP, take three

Liqiang\ wrote:
> 
> PA-PK-OCSP-REQ is sent by the client in the AS-REQ, and PA-PK-OCSP-REP

> is sent by the KDC in the AS-REP.  Note that neither the order of 
> PA-PK-OCSP-REQ and PA-PK-AS-REQ, nor the order of PA-PK-OCSP-REP and 
> PA-PK-AS-REP, is specified.

I don't like the idea of completely seperating the OCSP from the AS
exchange and even have it unordered.

Didn't PKINIT say that the KDC may have different certs and select an
appropriate cert based on the list of trusted CAs sent by the client in
the AS-REQ?  The KDC would know exactly which OCSP the client might need
**after** processing the AS-REQ.

And if the two requests are combined into a single ordered handshake
message then it would save a roundtrip which I consider a valuable
feature.

-Martin

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 15 Jul 2004 14:52:11 -0700

Martin Rex wrote:

> Nicolas Williams
> > 
> >  - The term "tunnel" is misleading here, as evidenced by the trouble
> >    that Martin had earlier with your proposal, as well as my own
> >    confusion -- OCSP requests, after all, are not transported by
PKINIT,
> >    just responses.

> Yup, I was also puzzled to still see the word "tunnel" in the
headline.

Fine, Remove the word tunnel/tunneling. If this is selected into the
draft, I will remove the word tunnel. 

Larry

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Thursday, July 15, 2004 2:45 PM
To: Nicolas Williams
Cc: Liqiang(Larry) Zhu; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: OCSP, take three

Nicolas Williams wrote:
> 
> I have only a few comments left:
> 
>  - We may need an error code for the KDC to indicate that a cert/OCSP
>    response pair are insufficiently fresh; clients can then get a
fresh
>    OCSP response and try again.
> 
>    Note that this error is not specific to OCSP but generic to PKI
>    ("your cert is too long lived and I can't verify that it's not been
>    revoked without your help; send a CRL or OCSP response").

Actually *really* dislike this particular request.  Supplying a cached
OCSP response should be a mere short cut, not a requirement.  In
particular for the PKINIT case, the **KDC** must NOT harass the client
about an expired OCSP response supplied by the client.  If the KDC
requires an OCSP response and the client has either not sent one at all
or one that the KDC dislikes for whatever reason, then the KDC should go
out and perform the OCSP request/response directly with an OCSP server.

> 
>  - The term "tunnel" is misleading here, as evidenced by the trouble
>    that Martin had earlier with your proposal, as well as my own
>    confusion -- OCSP requests, after all, are not transported by
PKINIT,
>    just responses.

Yup, I was also puzzled to still see the word "tunnel" in the headline.

-Martin