Re: [Ipsec] RE: OCSP in IKEv2

[Nicolas Williams <Nicolas.Williams@sun.com>]

On Tue, Aug 10, 2004 at 06:41:45PM -0700, Paul Hoffman / VPNC wrote:
> At 4:31 PM -0700 8/9/04, Michael Myers wrote:
> >BTW, the ADs have agreed this I-D will be placed onto the Standards
> >Track, subject to resolution of comments.
> 
> Such a statement seems wildly premature for a -00 document.
> 
> To date, there has been nearly zero interest from anyone in the IPsec 
> vendor community for in-band OCSP. Further, I am unaware of any deman 
> from the VPN user community for this. Having a standards-track 
> document will lead some to think that vendors are supposed to support 
> this. Given that there is no actual need for handling OCSP in IPsec, 
> the document should not move on to standards track; Experimental 
> status is fine.

Let me confirm that there is interest in this general use of OCSP: that
each peer that can sends OCSP response(s) for *its* certificate.

Michael's I-D helped clear up some confusion about "OCSP tunnelling" in
the KRB WG; "OCSP tunnelling" is not a good way to describe this as
there's no exchange of OCSP _requests_ and responses, just responses.

Think of this as a way of sending a CRL in-band but not in the cert,
with the benefit that the overall size of an OCSP response for one cert
is, practically speaking, constant, as opposed to the practically
unbounded size of CRLs.

Nico
-- 

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec