Subject: Signing of OCSP responses

From: "Erik Andersen" <[email-masked]>
Date: Wed, 6 May 2009 10:10:27 +0200

Hi,

I have a question that may disclose my ignorance, but I will try anyway.

The ASN.1 indicates and so does the text of 4.2.1 that ResponseData is
signed. The ResponseData includes the status for all certificates for which
status information is requested. It is also my understanding that these
certificates may have different issuing CAs.

However, 4.2.2.2 makes one believe that the status information for
certificates are individually signed.  

Erik Andersen

Andersen's L-Service

Elsevej 48, DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "Liaquat Khan" <[email-masked]>
Date: Wed, 6 May 2009 13:53:03 +0400

Hi Erik

This question comes up now and then (assuming I understand you correctly).
One way to manage this is for the OCSP responder public key to be certified
by each of the CA's for which it responds.  Then the OCSP responder should
return all the responder certificates issued by the CAs for which it is
responding in that particular response. 

Regards,

Liaquat 

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Erik Andersen
Sent: 06 May 2009 12:10
To: PKIX
Subject: Signing of OCSP responses

Hi,

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "Erik Andersen" <[email-masked]>
Date: Wed, 6 May 2009 12:11:07 +0200

Hi Liaquat,

Thanks for your reply. It appears to me that RFC 2560 is not always that
precise. In addition, it refers to obsolete RFCs.

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----
From: Liaquat Khan [mailto:[email-masked]] 
Sent: 6. maj 2009 11:53
To: 'Erik Andersen'; 'PKIX'
Subject: RE: Signing of OCSP responses

Hi Erik

Regards,

Liaquat 

  _____  

Hi,

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: Stephen Kent <[email-masked]>
Date: Wed, 6 May 2009 11:07:20 -0400

Erik,

A more common OCSP scenario is one in which the RPs acquire certs for 
OCSSP servers via an out-of-band means, e.g., via configuration. 
These RPs are administratively directed to rely on the responses from 
these servers.

Steve

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 07 May 2009 19:59:01 +1200

"Erik Andersen" <[email-masked]> writes:

>precise.

It has been called "schizophrenic" because it allows for all of the
conflicting business models of the various contributors in the same RFC.  This
does not help with interpretation :-).

Peter.

---

From: "Erik Andersen" <[email-masked]>
Date: Thu, 7 May 2009 10:34:27 +0200

Hi Peter,

When I do not understand something, it is either because I am stupid or
because it is not understandable. I am always happy when the latter seems to
be the case.

Erik Andersen
Andersen's L-Service

-----Original Message-----
From: pgut001 [mailto:[email-masked]] 
Sent: 7. maj 2009 09:59
To: [email-masked]; [email-masked]
Subject: RE: Signing of OCSP responses

It has been called "schizophrenic" because it allows for all of the
conflicting business models of the various contributors in the same RFC.
This
does not help with interpretation :-).

Peter.