Re: [Ipsec] RE: OCSP in IKEv2

[Bill Sommerfeld <sommerfeld@east.sun.com>]

Experimental doesn't seem to fit; it seems to me more of a
*limited-applicability* standards track document..

I can see two obvious use cases for tunneling OCSP through IKE:

 1) the "PKI infrastructure servers inside the security perimeter"
    case discussed at some length within the pki4ipsec working group.

 2) when transport mode ipsec is used and you need to talk to the OCSP
    server itself.

Both of these break a possible chicken-and-egg dependancy cycle (need
IPsec to speak OCSP; need OCSP to establish IPsec SA).

							- Bill







_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec