Subject: RE: DPD & DPV requirements - to nonce or not to nonce?

From: Peter Sylvester <[email-masked]>
Date: Thu, 1 Feb 2001 19:18:01 +0100 (MET)

> 
> OK, now I see the crux of this issue. Yes, for DPD, a returned OCSP 
> response, even if it carries an optional nonce, does not provide the 
> desired freshness guarantee for the client, who is unable to 
> independently evaluate the timeliness of the response. Our current 
> proposal implicitly requires the client to trust the DPD server, 
> which violates our model for DPD vs. DPV.

An OCSP responce contains a ProducedAt field. 

Similar as with a CRL obtained from a directory a client has to
determine the freshness of the response.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 1 Feb 2001 14:04:00 -0500

>determine the freshness of the response.

Whoops. I missed that. OK, so we don't have a freshness problem any 
worse than for a CRL. That brings it back to the issue of trusting 
the DPD server to return the freshest one available, OR having an 
option for the client to insist (request?) that his own nonce be used 
to request a very fresh response, OR letting the client specify a 
required freshness that will satisfy its requirements (thus allowing 
more leeway for the server).

Any suggestions as to which of these is preferable?

Steve