Subject: RE: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 1 Jun 2005 16:21:11 -0700

[email-masked] wrote:
> verifyWithOCSP(Cert) -> BOOLEAN
This is what we have; it is clearly more efficient than the other you
proposed.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, June 01, 2005 3:50 PM
To: Liqiang(Larry) Zhu
Cc: Chaskiel M Grundman; [email-masked]
Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

On Wed, Jun 01, 2005 at 03:44:21PM -0700, Liqiang(Larry) Zhu wrote:
> The information how the OCSP was obtained (for which certificate) is
> lost.

It's not.

The API roughly should be like this:

getOCSPResponse(Cert) -> OCSPResponse
getOCSPResponse(Cert, ...) -> SEQUENCE OF OCSPResponse
getOCSPResponsesForChain(Cert) -> SEQUENCE OF OCSPResponse
getOCSPResponsesForChains(Cert, ...) -> SEQUENCE OF OCSPResponse

verifyWithOCSPResponse(Cert, OCSPResponse) -> BOOLEAN
verifyWithOCSPResponses(Cert, SEQUENCE OF OCSPResponse) -> BOOLEAN

Whereas an API like this:

verifyWithOCSP(Cert) -> BOOLEAN

is clearly not useful in this case.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 1 Jun 2005 18:23:38 -0500

> This is what we have; it is clearly more efficient than the other you

It clearly does not match the model of this I-D though.

Good luck,

Nico
--

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 02 Jun 2005 12:33:05 -0400

Larry:

What does your

function do?   That looks to me as if it will perform its own OSCP
request.   Is this being executed by the PKINIT client or the KDC?

Jeffrey Altman