Subject: RE: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 2 Jun 2005 17:43:53 -0700

The draft does not ask the client to fail if the responses are not
ordered. It only asks something trivial to the sender in order to make
it easier for the receiver to pick up the responses.

-- Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey Altman
Sent: Thursday, June 02, 2005 2:08 PM
To: [email-masked]
Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

Sam Hartman wrote:

> So do we want to go beyond Larry's requirement and make it be ordered
> beyond the first response?

I completely agree that ordering the responses to match the order of the
chain is a wonderful optimization but if the goal here is
interoperability the rule is be strict about what you send and be
liberal with what you accept.  This practice argues for a SHOULD send
ordered and MUST accept unordered.  At most it is O(n) work for the
client to validate a cert with an unordered list of n responses.

Jeffrey Altman

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 02 Jun 2005 21:57:17 -0400

Larry:

If you say the server MUST do X, then the client can be programmed
to assume the server is going to do X.   If you say the server SHOULD do
X, then the client will have to be programmed to expect not X.

Please change the MUST to a SHOULD.

Jeffrey Altman