Re: LCUP Comment/Question

This is a cryptographically signed message in MIME format.

--------------ms000105030700040509070308
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Mark C Smith wrote:

>
> John McMeeking wrote:
>
>> ... Maybe some words like:
>>
>> Use of an LCUP cookie with multiple DSAs in a replicated environment 
>> is not
>> defined by LCUP.  An implementation of LCUP may support continuation 
>> of a
>> LCUP session with another DSA holding a replica of the LCUP context.  In
>> such cases, the implementation should document the LCUP Scheme used.  In
>> the absence of knowledge about such support the client should not use a
>> LCUP cookie with any DSA other than the DSA which issued the original
>> cookie. 
>
I think this text should be sufficient.

>> Or something that conveys the notion that it isn't defined by LCUP, but
>> isn't prohibited.  And leave the door open for vendors (or later 
>> standards)
>> to address this.  And the "document the scheme" part needn't involve
>> defining an OID and having the client request that format.  I'd hope 
>> that
>> an implementation of LCUP in an replicated environment would support 
>> this
>> with its default LCUP scheme.
>
>
> My too. I thought we discussed this before... LCUP needs to allow 
> implementations to support using the same cookie with different 
> replicas, and needs to gracefully handle the case where an 
> implementation does not support it. For example, if a server does not 
> recognize the cookie or can't use the information contained in it, it 
> may force a full refresh... but that decision is in the hands of the 
> server. I do not think there is any need for the implementation to 
> document the cookie scheme or for the client to be careful in this 
> case... what am I missing? Server implementations must be able to 
> recognize whether a cookie presented by a client is one they sent or a 
> compatible cookie (e.g., one sent by a replica).
>

--------------ms000105030700040509070308
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIL6zCC
A9YwggM/oAMCAQICBAIAAeYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCVVMxGDAWBgNV
BAoTD0dURSBDb3Jwb3JhdGlvbjEcMBoGA1UEAxMTR1RFIEN5YmVyVHJ1c3QgUm9vdDAeFw0w
MTA2MDExMjQ3MDBaFw0wNDA2MDEyMzU5MDBaMIGTMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
Q0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxGzAZBgNVBAoTEkFtZXJpY2EgT25saW5lIElu
YzEZMBcGA1UECxMQQU9MIFRlY2hub2xvZ2llczEnMCUGA1UEAxMeSW50cmFuZXQgQ2VydGlm
aWNhdGUgQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDi718sdkOJSxpf
s+X4qm+LL4FNZ/+9Sg9jLsTchfaeLEkmIP8AF+SIiGne/YNX4KMRGRGq1ty877PSFS5Uxm58
v9m5w0bTCQWE5VNcSO2EhZoOOz0WB1zws3mrmhClvMGk0XhMBuVkQfwFJWMm6+8Mx25UoYzO
VFe2H5LashJLjQIDAQABo4IBgjCCAX4wTQYDVR0fBEYwRDBCoECgPoY8aHR0cDovL3d3dzEu
dXMtaG9zdGluZy5iYWx0aW1vcmUuY29tL2NnaS1iaW4vQ1JML0dURVJvb3QuY2dpMB0GA1Ud
DgQWBBQp27Itg35/iyO7wsxmuTnoKfMChjBmBgNVHSAEXzBdMEYGCiqGSIb4YwECAQUwODA2
BggrBgEFBQcCARYqaHR0cDovL3d3dy5iYWx0aW1vcmUuY29tL0NQUy9PbW5pUm9vdC5odG1s
MBMGAyoDBDAMMAoGCCsGAQUFBwIBMFgGA1UdIwRRME+hSaRHMEUxCzAJBgNVBAYTAlVTMRgw
FgYDVQQKEw9HVEUgQ29ycG9yYXRpb24xHDAaBgNVBAMTE0dURSBDeWJlclRydXN0IFJvb3SC
AgGjMCsGA1UdEAQkMCKADzIwMDEwNjAxMTI0NzMwWoEPMjAwMzA5MDEyMzU5MDBaMA4GA1Ud
DwEB/wQEAwIBBjAPBgNVHRMECDAGAQH/AgEBMA0GCSqGSIb3DQEBBQUAA4GBAEpiDtn6RncE
CmwN3f7SIjmZEAquiC2GPVeE5hIkN2n7WV7iEbD5n6RXhoppHwZj0X3uMzZJECAPH5cXLCds
PWw5BHviReiHG1S2YEFtHa4F8535OjSa43trTHH466grg7A1kEwZaHHt8GMiXsJb7CB6tbBR
c+kH7oFndnlT95XUMIIEBDCCA22gAwIBAgICb4cwDQYJKoZIhvcNAQEFBQAwgZMxCzAJBgNV
BAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEbMBkGA1UEChMS
QW1lcmljYSBPbmxpbmUgSW5jMRkwFwYDVQQLExBBT0wgVGVjaG5vbG9naWVzMScwJQYDVQQD
Ex5JbnRyYW5ldCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDMwNzE3MTI0MjU4WhcNMDQw
MTEzMTI0MjU4WjB9MQswCQYDVQQGEwJVUzEbMBkGA1UEChMSQW1lcmljYSBPbmxpbmUgSW5j
MRUwEwYKCZImiZPyLGQBARMFcmljaG0xITAfBgkqhkiG9w0BCQEWEnJpY2htQG5ldHNjYXBl
LmNvbTEXMBUGA1UEAxMOUmljaCBNZWdnaW5zb24wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
AoGBAM0xzJVFg2ipLH24lRTenspJ6r43StzZDCOzysfywnc6TkwnkHI2ZXJ/2NUa5nfUMVL0
wrajB6evmyIb5Q81HC3IqHB7ltCQcU+jwTgl5QvhdGj5FTGYTV6SxyLrWfTXsFObq9oONdwl
+egskUTRKY/DqzfooL1oaLfdreKcBmvBAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCBSAw
HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGCWCGSAGG+EIBDQQ2FjRJc3N1ZWQg
YnkgTmV0c2NhcGUgQ2VydGlmaWNhdGUgTWFuYWdlbWVudCBTeXN0ZW0gNC41MIGbBgNVHREE
gZMwgZCBEnJpY2htQG5ldHNjYXBlLmNvbYEOcmljaG1AbWNvbS5jb22BF3JpY2hfbWVnZ2lu
c29uQG1jb20uY29tgRtyaWNoX21lZ2dpbnNvbkBuZXRzY2FwZS5jb22BG3JtZWdnaW5zb24w
MjI0QG5ldHNjYXBlLmNvbYEXcm1lZ2dpbnNvbjAyMjRAbWNvbS5jb20wHwYDVR0jBBgwFoAU
KduyLYN+f4sju8LMZrk56CnzAoYwQQYIKwYBBQUHAQEENTAzMDEGCCsGAQUFBzABhiVodHRw
Oi8vY2VydGlmaWNhdGVzLm5ldHNjYXBlLmNvbS9vY3NwMA0GCSqGSIb3DQEBBQUAA4GBAH1a
Cx0wGJLNPmAQp2GaSV+ICOvOn2capnZr5q1h63Wm+NS4lVK7liHoXjxbDNLPTcXmzUVXmcpg
gP5yT25Pueb/rUoVR4UOOt9MUf0vAOqR849VYzRSvLtks1oI3e51S0EgM20f7FwF1ec1a7Fa
buMyteo6vMEZlet5mCWVO1o+MIIEBTCCA26gAwIBAgICb4gwDQYJKoZIhvcNAQEEBQAwgZMx
CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEbMBkG
A1UEChMSQW1lcmljYSBPbmxpbmUgSW5jMRkwFwYDVQQLExBBT0wgVGVjaG5vbG9naWVzMScw
JQYDVQQDEx5JbnRyYW5ldCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDMwNzE3MTI0MjU4
WhcNMDQwMTEzMTI0MjU4WjB9MQswCQYDVQQGEwJVUzEbMBkGA1UEChMSQW1lcmljYSBPbmxp
bmUgSW5jMRUwEwYKCZImiZPyLGQBARMFcmljaG0xITAfBgkqhkiG9w0BCQEWEnJpY2htQG5l
dHNjYXBlLmNvbTEXMBUGA1UEAxMOUmljaCBNZWdnaW5zb24wgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAMxIyDbN22w/X3RLlXYEzqbSJtCxFwKBdAAyTIyasbUm4TnKdjpUfcf0cUN/
eD/zuItQ8wYqOosRQwXqKd6BtS/AL6kSjBDQhizXCzLbhoL4dWF4inxYgX3S26RenSGm+PZM
uU93PvmosYjcwwSawd4cYyOS/bwydDR44l5zm4i9AgMBAAGjggF7MIIBdzAPBgNVHQ8BAf8E
BQMDB4AAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBDBglghkgBhvhCAQ0ENhY0
SXNzdWVkIGJ5IE5ldHNjYXBlIENlcnRpZmljYXRlIE1hbmFnZW1lbnQgU3lzdGVtIDQuNTCB
mwYDVR0RBIGTMIGQgRJyaWNobUBuZXRzY2FwZS5jb22BDnJpY2htQG1jb20uY29tgRdyaWNo
X21lZ2dpbnNvbkBtY29tLmNvbYEbcmljaF9tZWdnaW5zb25AbmV0c2NhcGUuY29tgRtybWVn
Z2luc29uMDIyNEBuZXRzY2FwZS5jb22BF3JtZWdnaW5zb24wMjI0QG1jb20uY29tMB8GA1Ud
IwQYMBaAFCnbsi2Dfn+LI7vCzGa5Oegp8wKGMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcw
AYYlaHR0cDovL2NlcnRpZmljYXRlcy5uZXRzY2FwZS5jb20vb2NzcDANBgkqhkiG9w0BAQQF
AAOBgQCs46Yi7zWvrRr02pvEVb5SRaOmYgUsydv4aUPQlHO3rx3e2e9Uc0rV1l0JNfcRGhGW
Kwt/RjbbXDVwEf7Fzi0eRyRuV+ffKHzkDcvE+AN8CldvociUFH3nJXGtAIIdbKOmCMkPkK8b
HXZ1M4+H8aCBQLriyq/b99gK11VeeFcifjGCA1QwggNQAgEBMIGaMIGTMQswCQYDVQQGEwJV
UzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxGzAZBgNVBAoTEkFtZXJp
Y2EgT25saW5lIEluYzEZMBcGA1UECxMQQU9MIFRlY2hub2xvZ2llczEnMCUGA1UEAxMeSW50
cmFuZXQgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AgJviDAJBgUrDgMCGgUAoIICDzAYBgkqhkiG
9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wMzA3MjMyMDMxNTRaMCMGCSqG
SIb3DQEJBDEWBBRm0RJfg3K8AzIESmhRM1VLZfigMDBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqG
SIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG
9w0DAgIBKDCBqwYJKwYBBAGCNxAEMYGdMIGaMIGTMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
Q0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxGzAZBgNVBAoTEkFtZXJpY2EgT25saW5lIElu
YzEZMBcGA1UECxMQQU9MIFRlY2hub2xvZ2llczEnMCUGA1UEAxMeSW50cmFuZXQgQ2VydGlm
aWNhdGUgQXV0aG9yaXR5AgJvhzCBrQYLKoZIhvcNAQkQAgsxgZ2ggZowgZMxCzAJBgNVBAYT
AlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEbMBkGA1UEChMSQW1l
cmljYSBPbmxpbmUgSW5jMRkwFwYDVQQLExBBT0wgVGVjaG5vbG9naWVzMScwJQYDVQQDEx5J
bnRyYW5ldCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkCAm+HMA0GCSqGSIb3DQEBAQUABIGAkZYk
ANxMtOcP6ZFpvk0JPvuCiLI20mX2XSTLpA5CLGhxDxKkFXgl3QTTqE8bnVO5b3fsB4zO3fvC
s/RubTa+r5H/N0BFy7SMJ7WPqlqe2mOlDIMSlLdo/s2w3UMo86xpTvrDLTJiH2tLGhdM/h03
9plswUZ4vHncQM4pOpAXL4cAAAAAAAA=
--------------ms000105030700040509070308--