Subject: RE: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 1 Jun 2005 14:38:59 -0700

Chaskiel M Grundman wrote:
> who is the 'signer'?
The "signer" means the KDC for AS_REP, and the client for the AS_REQ.

I can clarify this.

> 2) it seems like this will force the Kerberos implementation to
understand 

> ocsp and not just pass data in and out of a CMS library. That seems 
> unfortunate.

This is correct. The OCSP is sent outside of the CMS message in this
case.

-- Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Chaskiel M
Grundman
Sent: Wednesday, June 01, 2005 2:01 PM
To: [email-masked]
Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

--On Tuesday, May 31, 2005 23:09:42 -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> In order to simplify implementation and
> ensure compliant clients work with off-the-shelf OCSP responders, -05
is
> updated to say that the first OcspResponse MUST contain the OCSP
> response for the signer's certificate.

1) who is the 'signer'? the kdc? something else? the word 'signer'
doesn't 
appear anywhere else in this document or pkinit, and in 2560, it refers
to 
the ocsp responder. However, it doesn't make sense for there to be an
ocsp 
response for the ocsp signer itself.
2) it seems like this will force the kerberos implementation to
understand 
ocsp and not just pass data in and out of a CMS library. That seems 
unfortunate.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 1 Jun 2005 17:29:58 -0500

> This is correct. The OCSP is sent outside of the CMS message in this

I'm assuming -- and correct me if I'm wrong, please -- that APIs for
obtaining OCSP Responses will allow the caller to specify one or more
certs for which to get an OCSP Response.  It seems like the OCSP
protocol should map fairly cleanly onto an API, as long as developers
understand that OCSP Responses are useufl as tokens that can be
exchanged by peers there should be no problem.

Nico
--