Subject: Re: OCSP - Adoption of response models

From: [email-masked]
Date: Fri, 4 Apr 2003 14:26:27 +0000

> Thus it is possible to use one OCSP-Responder signed by the Root-CA to
> answer for all Sub-CAs. Interesting idea. But afaik not RfC-conform.

I have referred to this one in the past as the 'Family model'
wherein if its OK with the head of the family (the Root CA)
then its OK with the rest of the family. To me it seems a
logical extension of the Root of trust principle on which
much of PKI is based.

Of course, within the RFC it *is* compliant within what Peter has
described 'Everything else' bucket.

Chris

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Fri, 4 Apr 2003 08:48:47 -0800

This model does solve a real problem especially in complex PKIs, on the same note it does concern me though; today  a issuer has no direct control (other than policy) over the certificates his subordinate issues this model changes that and I am not sure how I feel about that.

In general I have always described the OCSP trust models as follows:
direct - I directly trust a ocsp responder to respond for a particular ca (or set)
va delegated - I directly trust a ocsp responder/ca to issue certificates to other responders I will trust through delegation. This delegation is restricted to one level (e.g. only the root is a ca)
ca delegated - ca assigns the ability to sign responses for his certificates by issuing a OCSP Signing certificate to a responder. In this case if the responder was to respond for more than one CA he has a certificate from each ca, but each certificate uses the same key. The response uses the key based responder id vs a name based one; not all client implementations support this form of responder identification. 
ca signed - ca who issued the certificate issued the response, no eku needed but it should be present.

From: [email-masked]
Sent: Fri 4/4/2003 6:26 AM
To: Florian Oelmaier
Cc: [email-masked]
Subject: Re: OCSP - Adoption of response models

Chris