Re: [Spasm] An OCSP response extension

[Sean Turner <[e-mail]>]

> On Mar 9, 2017, at 22:15, Ryan Sleevi <[e-mail]> wrote:
> 
> 
> 
> On Thu, Mar 9, 2017 at 9:13 PM, Sean Turner <[e-mail]> wrote:
> If this is going to be get widely implemented should we look at updating RFC5019 which says:
> "The responder SHOULD NOT include responseExtensions”?
> 
> How do you see "widely implemented”?

I naively was thinking along the “worldly” level (aka WebPKI).

> I mentioned to Rich privately, but I think this is something that the CA/Browser Forum should consider profiling out and expressly forbidding for the time being, and if later ended up valuable (e.g. in the context of must-staple certificates), would need to aggressively profile the acceptable values suitable for the Web PKI.
> 
> In the context of other PKIs, however, I have no thought and experience to inform on the value of that, which is why I was asking about "widely implemented" - for example, if used by the FPKI or Grid PKI, would that be "widely implemented"? If 5019 dropped the SHOULD NOT for that reason, would the CA/B Forum need to profile it back in for the Web PKI?

So this is an interesting point and it’s kind of like when we looked at profiling OCSP for STIR (i.e., getting cert status for originators of digital signed SIP requests).  The HA OCSP profile was close to what we wanted so we use it as the base and then profiled stuff in (in some case back in and in some cases new stuff in).  If the HA OCSP profile had an applicability statement, which really nobody was doing back in the day, then it would be clear where it applied and where it didn’t.  I’m certainly not proposing anybody write up an applicability statement because well different communities can profile it as they see fit.  The only wrinkle here is that some communities are more hesitant than other to profile things back in because they get push back about being “non-standard,” but this might just have to go with the territory.

spt