operational protocols

[Stef Hoeben <[e-mail]>]

Hello,

Some questions about the ipki2opp-00 draft (by the way,
nice work:)

- In the abstract, it looks like only the OCSP protocol
can be use for online checking. But this is also possible
with the LDAP protocol, isn't it? Isn't the only difference
that LDAP gives the whole certificate or CRL, while the
OCSP only gives the status?

- Do you put the OCSP protocol _in_ an HTML file? Do you
have to define new tags?  Are there examples avaiable 
somewhere? Do Netscape and Microsoft have to put this 
procotol in their browsers? (Sorry for the dumb questions.)

- A small remark about the security of LDAP: it is true
that the messages don't need to be signed because the CA
allready signed the certs ans CRL. BUT a nasty LDAPd could
just answer on a request: 'I don't have that certificate
or CRL' while he actually does have it. 
Perhaps a way to solve this is a CIL or Certficate Issue List 
(it's in a paper by Silvio Micali, you can find a copy at
http://www.esat.kuleuven.ac.be/~hoeben/micali.ps). In that
list the CA just puts the serial numbers of the certs (eventually
after removing some redundancy) and signs it. If there comes a 
request for a cert the CA didn't issue, the LDAPd just gives
the CIL to prove he hasn't got the cert.
I guess this CIL is allready possible in X.509 v3, with the
aid of private extensions, isn't it?

			Greetings, Stef