Subject: Re: OCSPv2 certHash option will be deleted

From: [email-masked] (Peter Gutmann)
Date: Tue, 3 Apr 2001 06:05:28 (NZST)

"Michael Myers" <[email-masked]> writes:

>We're going to take the certHash option out of ReqCert for the -03 rev. Anyone
>who cares for it, now's the time to speak up.

Well just for form's sake I'll have to register some dissatisfaction with this,
but given the issues which James Manger raised I guess it can't be salvaged.

One thing I would like to see included (and others have raised this issue in
the past) is that a responder MUST return a response identified in the same way
as the request (ie if the client sends in an issuerSerial, you can't come back
with a pKCert or certID).  I suspect everyone will do this automatically
anyway, but it'd be better to have it made explicit so we can beat the authors
of any new implementations with soggy weetbix if they decide to rewrite the IDs
in the response.

Peter.