Subject: RE: OCSP I-Ds going forward

From: "Tom Gindin" <[email-masked]>
Date: Tue, 3 Dec 2002 07:56:10 -0500

What I am suggesting is that those four existing structures are the
only ones needed, that no more than two of them are ever needed in the same
request, and that the only useful combinations of two in a single request
are those of CertID with one of the others.   The reasons for this made up
most of my posting yesterday.

            Tom Gindin

"Michael Myers" <[email-masked]> on 12/02/2002 06:01:49 PM

To:    Tom Gindin/Watson/IBM@IBMUS
cc:    "Phillip H. Griffin" <[email-masked]>, "Peter Gutmann"
       <[email-masked]>, <[email-masked]>,
       <[email-masked]>
Subject:    RE: OCSP I-Ds going forward

Tom,

Am I correct in inferring that your are advocating:

> This reduces the matrix to four single fields
> (CertID, fullCertificate, issuerSerial, and ESSCertID)

Mike

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 04 Dec 2002 10:43:27 +0100

Tom,

> most of my posting yesterday.

About the four structures:

1) CertID: it is needed for backward compatibility.

2) fullCertificate: Yes.

3) issuerSerial: No, since it does not allow to differentiate
     between two CAs that have the same DN.

4) ESSCertID: No, since it does not allow an OCSP Responder to use CRLs only
    (I have been advocating that form, but I am not advocating it anymore).

Now a fifth structure replaces that last case: certIDWithSignature.
The full explanations for certIDWithSignature are in the document
http://www.ietf.org/internet-drafts/draft-ietf-pkix-ocspv2-ext-00.txt

So this leaves only three structures:
CertID, fullCertificate and certIDWithSignature.

Denis