Subject: RE: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 1 Jun 2005 15:44:21 -0700

The information how the OCSP was obtained (for which certificate) is
lost.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, June 01, 2005 3:43 PM
To: Liqiang(Larry) Zhu
Cc: Chaskiel M Grundman; [email-masked]
Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

On Wed, Jun 01, 2005 at 03:36:22PM -0700, Liqiang(Larry) Zhu wrote:
> Nicolas.Williams wrote:
> > I'm assuming -- and correct me if I'm wrong, please -- that APIs for

> > obtaining OCSP Responses will allow the caller to specify one or
more 
> > certs for which to get an OCSP Response.  It seems like the OCSP
> protocol 
> > should map fairly cleanly onto an API, as long as developers
> understand 
> > that OCSP Responses are useufl as tokens that can be exchanged by
> peers > 
> > there should be no problem.
> 
> You are correct. But the information is lost when we send the OCSP
> responses over the wire.

What information is lost?

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 1 Jun 2005 17:50:11 -0500

> The information how the OCSP was obtained (for which certificate) is

It's not.

The API roughly should be like this:

getOCSPResponse(Cert) -> OCSPResponse
getOCSPResponse(Cert, ...) -> SEQUENCE OF OCSPResponse
getOCSPResponsesForChain(Cert) -> SEQUENCE OF OCSPResponse
getOCSPResponsesForChains(Cert, ...) -> SEQUENCE OF OCSPResponse

verifyWithOCSPResponse(Cert, OCSPResponse) -> BOOLEAN
verifyWithOCSPResponses(Cert, SEQUENCE OF OCSPResponse) -> BOOLEAN

Whereas an API like this:

verifyWithOCSP(Cert) -> BOOLEAN

is clearly not useful in this case.

Nico
--