[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Ipsec] RE: OCSP in IKEv2
On Wed, Aug 11, 2004 at 03:16:31PM -0700, Paul Hoffman / VPNC wrote:
> At 4:49 PM -0400 8/11/04, Bill Sommerfeld wrote:
> >I can see two obvious use cases for tunneling OCSP through IKE:
"tunnelling" is confusing here as only OCSP responses would be
exchanged, not requests.
> Um, the proposal has nothing to do with tunneling OCSP through IKE:
> it covers how to pass OCSP responses from one peer to another. Thus,
> in order for this proposal to be useful, the replying party has to
> have a fresh OSCP response about itself to hand to the querying party.
Bingo. And that is where the payoff is as this proposal maximizes the
use of cached OCSP requests because the user of a cert, not its peers,
is the one that gets the OCSP responses for its cert.
Cheers,
Nico
--
_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec