Subject: Re: OCSP - Adoption of response models

From: [email-masked] (Peter Gutmann)
Date: Fri, 4 Apr 2003 21:30:30 +1200

[email-masked] writes:

>RFC2560 offers three valid response models for OCSP (Two too many in my
>opinion)
>
>i.   Signed by the CA
>ii.  Signed by a VA with explicit delegation by the CA
>iii. A local model

Actually it offers an infinite number of models: (i), (ii), and (everything
else).  (And even within the above, there are a pile of sub-variations that
you can enable with OIDs and adding extra bits and pieces to messages).  Which
variant is best depends on which of the RFC authors you ask, and to some
extent who they're employed with at the time they offer their opinion.

>Does anyone have a feel for which model boasts the most widespread adoption ?
>I feel it should be ii) but suspect its iii) Deployment of the technology
>appears to be too scarce at present to make a sensible judgement.

Definitely (iii).  Note that a significant subset of (iii) is:

(iii-a) We don't check the signature on the response, we're only doing this to
        comply with some regulatory requirement.

Peter.

---

From: [email-masked]
Date: Fri, 4 Apr 2003 12:51:01 +0200

Hi Chris,

     I should also think that it is the response model II). But who
thrust/signs the certificate of the VA.

Friendly greetings,
Utimaco Safeware - Digital Transaction Security

David Tillemans
Project Leader

Tel.     +32 (0)16 440135
Fax.     +32 (0)16 440140
mailto:[email-masked]
Internet   http://www.utimaco.be
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

This email is confidential and intended solely for the use of the
individual to whom it is addressed. If you are not the intended recipient,
be advised that you have received this email in error and that any use,
dissemination, forwarding, printing or copying of this email is strictly
prohibited. If you have received this email in error please notify the
sender by telephone on +3216440135
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

                    chris.gilbert@roya                                                                                 
                    lmail.com                To:     [email-masked]                                                 
                    Sent by:                 cc:                                                                       
                    owner-ietf-pkix@ma       Subject:     OCSP - Adoption of response models                           
                    il.imc.org                                                                                         

                    04/04/2003 11:46                                                                                   

RFC2560 offers three valid response models for OCSP (Two too many
in my opinion)

i.   Signed by the CA

Does anyone have a feel for which model boasts the most widespread
adoption ? I feel it should be ii) but suspect its iii) Deployment of the
technology appears to be too scarce at present to make a sensible
judgement.

Opinions appreciated

Chris

This  email  and  any  attachments  are confidential and intended for the
addressee
only.   If  you are not the named recipient, you must not use, disclose,
reproduce,
copy  or  distribute the contents of this communication.  If you have
received this
in error, please contact the sender and then delete this email from your
system.

---

From: [email-masked]
Date: Fri, 4 Apr 2003 12:22:42 +0000

Hello David

> thrust/signs the certificate of the VA.

The response from the VA should be signed using keys issued by
the CA in the Issuer field of the certificate being queried
(and thus the issuer of the CRL that might contain that
certificate's serial number). The certificate sent with the
response must have OCSP-signing in the Extended Key Usage field.

Chris