Subject: RE: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 1 Jun 2005 15:36:22 -0700

Nicolas.Williams wrote:
> I'm assuming -- and correct me if I'm wrong, please -- that APIs for 
> obtaining OCSP Responses will allow the caller to specify one or more 
> certs for which to get an OCSP Response.  It seems like the OCSP
protocol 
> should map fairly cleanly onto an API, as long as developers
understand 
> that OCSP Responses are useufl as tokens that can be exchanged by
peers > 
> there should be no problem.

You are correct. But the information is lost when we send the OCSP
responses over the wire.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, June 01, 2005 3:30 PM
To: Liqiang(Larry) Zhu
Cc: Chaskiel M Grundman; [email-masked]
Subject: Re: ID draft-ietf-krb-wg-ocsp-for-pkinit-05

On Wed, Jun 01, 2005 at 02:38:59PM -0700, Liqiang(Larry) Zhu wrote:
> Chaskiel M Grundman wrote:
> > who is the 'signer'?
> The "signer" means the KDC for AS_REP, and the client for the AS_REQ.
> 
> I can clarify this.
> 
> > 2) it seems like this will force the Kerberos implementation to
> understand 
> 
> > ocsp and not just pass data in and out of a CMS library. That seems 
> > unfortunate.
> 
> This is correct. The OCSP is sent outside of the CMS message in this
> case.

I'm assuming -- and correct me if I'm wrong, please -- that APIs for
obtaining OCSP Responses will allow the caller to specify one or more
certs for which to get an OCSP Response.  It seems like the OCSP
protocol should map fairly cleanly onto an API, as long as developers
understand that OCSP Responses are useufl as tokens that can be
exchanged by peers there should be no problem.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 1 Jun 2005 17:42:55 -0500

> You are correct. But the information is lost when we send the OCSP

What information is lost?