Re: OCSPv2: 02: certHash is not unique

[Denis Pinkas <[e-mail]>]

Ambarish,

I second your position.

Denis

> Mike,
>     As I have said a few times before, I strongly oppose the
> idea of using certHash as a method of identifying the certificate
> whose status you want to check. It forces the responder to have
> access to information that is not normally available to most
> responders - even those run by most CAs (AFAIK).
> 
> I don't know that we are saving all that many bytes by using
> certHash as opposed to certID.
> 
> It just doesn't make sense to me that we provide 5-6 different
> ways of identifying a certificate in OCSP - I think it will
> lead to a lot more interop problems, without buying us any
> additional functionality.
> 
> Regards,
> Ambarish
> 
> ---------------------------------------------------------------------
> Ambarish Malpani
> Architect                                                650.567.5457
> ValiCert, Inc.                                  [e-mail]
> 339 N. Bernardo Ave.                          http://www.valicert.com
> Mountain View, CA 94043
> 
> > -----Original Message-----
> > From: Michael Myers [mailto:[e-mail]]
> > Sent: Wednesday, March 28, 2001 5:59 PM
> > To: [e-mail]; [e-mail]; [e-mail]
> > Subject: RE: OCSPv2: 02: certHash is not unique
> >
> >
> > Peter,
> >
> > After some correspondence, I've come to the same conclusion
> > despite my prior
> > proposal to Jim.  The high-level intent of the presence of an
> > option to
> > hash/fingerprint the cert was to enable alignment to known
> > practices, not
> > produce yet another variant.
> >
> > Mike
> >
> > > -----Original Message-----
> > > From: [e-mail] [mailto:[e-mail]]
> > > Sent: Thursday, March 29, 2001 9:47 AM
> > > To: [e-mail]; [e-mail]
> > > Subject: Re: OCSPv2: 02: certHash is not unique
> > >
> > >
> > > "Carlin Covey" <[e-mail]> writes:
> > >
> > > >I am quite content with the suggestion that Jim made concerning
> > > computing the
> > > >certHash over only the signed portions of the certificate.
> > >
> > > I'm not.  I already have to create, track, store, and process a
> > > whole pile of
> > > certificate identifiers, and adding yet another wierdo
> > identifier which is
> > > compatible with nothing else in existence to that pile when
> > > there's no need for
> > > it to be incompatible is something which I can really do without.
> > >  The SHA-1
> > > hash of the whole cert as "fingerprint" is pretty much
> > > universally used and
> > > accepted, unless there's a very strong reason not to use it I
> > > don't see why we
> > > need to invent yet another new identifier.
> > >
> > > Peter.
> > >
> > >
> >