Subject: Question on OCSP response....

From: "Kwok Lee" <[email-masked]>
Date: Mon, 2 Feb 2004 10:57:20 -0500

Hi all,

I am not sure it is the place for this question. If not, hopefully, someone
can direct me to the right place.
Anyway, I am currently implementing a OCSP client, and I am using the
openvalidation.org's public ocsp responder (ocsp.openvalidation.org) to
verify my implementation. I am having a problem on the OCSP response I get
from the responder. When I use dumpasn1 to decode the BasicOCSPResponse, it
seems to me that the ResponseData is more like the following...

ResponseData ::= SEQUENCE {    
responderID          [1] EXPLICIT ResponderID,   
producedAt               GeneralizedTime,   
responses                SEQUENCE OF SingleResponse,   
responseExtensions   [1] EXPLICIT Extensions OPTIONAL }

instead of the one defined in the RFC 2560.

ResponseData ::= SEQUENCE {    
version              [0] EXPLICIT Version DEFAULT v1,   
responderID              ResponderID,   
producedAt               GeneralizedTime,   
responses                SEQUENCE OF SingleResponse,   
responseExtensions   [1] EXPLICIT Extensions OPTIONAL }

Did I miss something here ? Would someone mind to clarify that for me ?

Appreciate and thanks for any help...
kc

---

From: Bryan Pitcher <[email-masked]>
Date: Mon, 02 Feb 2004 09:47:24 -0700

Hi,

Could you post a base 64 or hex encoded response structure you that is 
exhibiting this improper encoding to the group?

Thx,
Bryan Pitcher

Kwok Lee wrote:

> Hi all,
>
> I am not sure it is the place for this question. If not, hopefully, 
> someone can direct me to the right place.
> openvalidation.org's public ocsp responder (ocsp.openvalidation.org) 
> to verify my implementation. I am having a problem on the OCSP 
> response I get from the responder. When I use dumpasn1 to decode the 
> BasicOCSPResponse, it seems to me that the ResponseData is more like 
> the following...
>

---

From: Dr Stephen Henson <[email-masked]>
Date: Mon, 02 Feb 2004 18:02:16 +0000

Kwok Lee wrote:

> verify my implementation. I am having a problem on the OCSP response I 
> get from the responder. When I use dumpasn1 to decode the 
> BasicOCSPResponse, it seems to me that the ResponseData is more like the 
> following...
> 

It could be OK based on DER.

The version field will normally be the DEFAULT value (v1) and it will 
thus be omitted.

The ResponderID is a CHOICE type:

    ResponderID ::= CHOICE {
       byName               [1] Name,
       byKey                [2] KeyHash }

If the Name option is present then there will be [1] EXPLICIT preceding 
the Name structure (the default module tagging is EXPLICIT).

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.

---

From: "Kwok Lee" <[email-masked]>
Date: Mon, 02 Feb 2004 13:23:14 -0500

I got it now. Thanks for the helps from everyone.