Re: [pkix] Straw-poll on OCSP responses for non-revoked certificates.

[Johannes Merkle <[e-mail]>]

Option 1 with strong support for Paul's request to change the name of this status (e.g. to "revoked or never issued").

While I agree to defining an extension signaling the new semantic, I deem it more important to have an extension
providing positive evidence (not just indication) of the fact that a certificate has been issued, e.g. by including a
hash of the certificate in question.

> It would
> be easy to adapt an attack to circumvent such response, for example by
> issuing a fake certificate that duplicates a legitimate serialNumber.

This attack would be prevented by returning in the response the hash value of the certificate.


Inclusion of a new status, as suggested in some answers, would require a new protocol version number.


Johannes