Re: Optimizing OCSP - Time for some spec work ?

On Fri 2019-10-25 at 23:49h, Niklas Matthies wrote on pkix:
[...]
>it would really be simpler and more flexible to just have a linear 
>sequence of regular basic responses. This could be achieved via a new 
>response type (responseType in ResponseBytes) for which the response 
>bytes consist of a sequence of basic responses instead of just one 
>basic response.

Here is an alternative idea, which, although being quite hackish, 
would be compatible with existing clients, would not require a new 
response type, while retaining the same flexibility: In the certs 
field of BasicOCSPResponse, add a dummy certificate carrying an 
extension containing the additional basic responses. That is, the 
certificate's sole purpose would be to serve as a container for the 
additional responses. The extension would have an ID identifying that 
particular purpose.

Note that both proposals have the benefit that they can be implemented 
on top of an existing OCSP responder (i.e. by a filter or proxy), as 
they don't change the data signed by the responder.

Niklas

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix