Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 01 Jun 2005 13:04:37 -0400

On Tuesday, May 31, 2005 11:09:42 PM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> 1) The PADATA number 17 was taken by PKINIT, so we would like to bump it
> up to 18.

I'm not sure how we ended up with this overlap, but I'll ask Cliff to check 
on the number allocations and make sure the numbers we are using in this 
document and in PKINIT are properly allocated so we don't end up with any 
more problems.

> 2) Based on MS OSCSP-for-PKINIT implementations in Longhorn release, we
> found it is very difficult to locate the OCSP response for the signer's
> certificate when there is more than one OCSP response. This is because a
> complete RFC2560 OCSP response can contain the responses for a
> collection of certificates. In order to simplify implementation and
> ensure compliant clients work with off-the-shelf OCSP responders, -05 is
> updated to say that the first OcspResponse MUST contain the OCSP
> response for the signer's certificate.

Note that this document has already passed last call and been given to Sam 
to take to the IESG.  He's been holding it until PKINIT is done, so it's 
not too late to make this update, but it does require a consensus call. 
So, I'll make that call now -- please send any comments for or against 
Larry's text by the end of next week or so.  The exact changes are the 
differences between ocsp-for-pkinit-04 and -05.

-- Jeff

---

From: Chaskiel M Grundman <[email-masked]>
Date: Wed, 01 Jun 2005 17:00:57 -0400

--On Tuesday, May 31, 2005 23:09:42 -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> In order to simplify implementation and

1) who is the 'signer'? the kdc? something else? the word 'signer' doesn't 
appear anywhere else in this document or pkinit, and in 2560, it refers to 
the ocsp responder. However, it doesn't make sense for there to be an ocsp 
response for the ocsp signer itself.
2) it seems like this will force the kerberos implementation to understand 
ocsp and not just pass data in and out of a CMS library. That seems 
unfortunate.