Subject: Re: LAAP performance issues

From: Stephen Farrell <[email-masked]>
Date: Sun, 07 Nov 1999 16:57:59 +0000

Hi Sean,

> The model in the draft doesn't explicitly restrict the model to be for
> the
> "never revoke" method in draft-ietf-pkix-ac509prof-01.txt.  Should we
> add a new
> request and response to support revocation or was it intended to use
> OCSP to get
> revocation information?

No to adding one and yes to using OCSP, which works just fine for
ACs (so long as issuer names/keys don't get confused).

Regards,
Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 647 7406
61 Fitzwilliam Lane,                    fax: +353 1 647 7499
Dublin 2.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 07 Nov 1999 16:56:17 +0000

Hi Andy,

> 1. Batch LAAP requests. 

Rather not, unless there's strong concensus. Remember that the
"L" in LAAP is for Limited. I expect that, in time, we'll have
a CMP/CMC equivalent which can handle this.

> 2.  Support for a "keep-alive" TCP connection between LRQ and LRP.

I hope that this will be discussed in DC, but in general, if the CMP
encapsulation is kept, then whatever CMP does will apply to LAAP.

Regards,
Stephen.

---

From: Sean Turner <[email-masked]>
Date: Wed, 10 Nov 1999 18:03:02 -0500

Stephen,

After seeing your presentation at the WG I can see why you'd not want to
support this in LAAP.  Can you just add the design assumptions you used (no
AC chains, no revocation, etc.) to the introduction?  Once you clear that up
I think you answered my concerns.

spt

---

From: "Andy Dowling" <[email-masked]>
Date: Thu, 11 Nov 1999 09:00:01 -0000

> a CMP/CMC equivalent which can handle this.

This could also prove useful in cases where AC chaining is used (if the idea
sticks).
(i.e. the LRQ makes a single LAAP request for an entire AC chain for
verification)
Although this does assume that a single LRP can provide an entire AC chain,
this
may be the case in some environments (corporate VPN).

Could be worth thinking about...

Regards,

Andy