Subject: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 31 May 2005 23:09:42 -0700

I would like to present two changes for this ID.

1) The PADATA number 17 was taken by PKINIT, so we would like to bump it
up to 18.

2) Based on MS OSCSP-for-PKINIT implementations in Longhorn release, we
found it is very difficult to locate the OCSP response for the signer's
certificate when there is more than one OCSP response. This is because a
complete RFC2560 OCSP response can contain the responses for a
collection of certificates. In order to simplify implementation and
ensure compliant clients work with off-the-shelf OCSP responders, -05 is
updated to say that the first OcspResponse MUST contain the OCSP
response for the signer's certificate.

Here is a link to the updated -05:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-ocsp-for-pkinit-05
.txt.

Thanks, -- Larry