Subject: RE: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 2 Jun 2005 10:14:13 -0700

I think I meant 

  verifyWithOCSPResponse(Cert, OCSPResponse) -> BOOLEAN

instead.

Currently it is for the KDC cert and this is verified by the client.

-- larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey Altman
Sent: Thursday, June 02, 2005 9:33 AM
To: [email-masked]
Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

Larry:

What does your

  verifyWithOCSP(Cert) -> BOOLEAN

function do?   That looks to me as if it will perform its own OSCP
request.   Is this being executed by the PKINIT client or the KDC?

Jeffrey Altman

Liqiang(Larry) Zhu wrote:

> [email-masked] wrote:
> 
>>verifyWithOCSP(Cert) -> BOOLEAN
> 
> This is what we have; it is clearly more efficient than the other you
> proposed.
> 
> 
> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]] 
> Sent: Wednesday, June 01, 2005 3:50 PM
> To: Liqiang(Larry) Zhu
> Cc: Chaskiel M Grundman; [email-masked]
> Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05
> 
> On Wed, Jun 01, 2005 at 03:44:21PM -0700, Liqiang(Larry) Zhu wrote:
> 
>>The information how the OCSP was obtained (for which certificate) is
>>lost.
> 
> 
> It's not.
> 
> The API roughly should be like this:
> 
> getOCSPResponse(Cert) -> OCSPResponse
> getOCSPResponse(Cert, ...) -> SEQUENCE OF OCSPResponse
> getOCSPResponsesForChain(Cert) -> SEQUENCE OF OCSPResponse
> getOCSPResponsesForChains(Cert, ...) -> SEQUENCE OF OCSPResponse
> 
> verifyWithOCSPResponse(Cert, OCSPResponse) -> BOOLEAN
> verifyWithOCSPResponses(Cert, SEQUENCE OF OCSPResponse) -> BOOLEAN
> 
> Whereas an API like this:
> 
> verifyWithOCSP(Cert) -> BOOLEAN
> 
> is clearly not useful in this case.
> 
> Nico

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 02 Jun 2005 13:24:18 -0400

Larry:

Thanks for that clarification.  Why does this function require
a special ordering in the OCSPResponse?

Jeffrey Altman

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 2 Jun 2005 12:28:23 -0500

> > Currently it is for the KDC cert and this is verified by the client.

Oh good, so you were lucky then :)

Nico
--