Re: [lamps] Considerations about the need to resume PKIX work

["Dr. Pala" <[e-mail]>]

Hi Rich, all,

I do really hope we will be able to provide some alternatives that might 
work in different environments - I will try to make more formal 
proposals soon for the charter items and milestones. Depending on which 
direction the WG wants to go, I'd be happy to help with the 
implementation in OpenSSL. We do have some sample code for OCSP over DNS 
for our OCSP responder - it is just demo code (not even close to be 
production ready :D) but it might be used as an example :D

I think few optimizations might be low-hanging fruits (e.g., 
distribution of rev info via DNS, reducing the response size for 
non-revoked entries) and some others might require more creative 
thinking (e.g., cumulative responses for full-chain validation).

These are just examples, and I am curious to know if there are other 
possible proposals on the table...

Cheers,
Max


On 7/31/17 10:27 AM, Salz, Rich wrote:
>
> I am also curious to see what concrete things could be done to improve 
> revocation.  If the answer is “nothing” that’s okay, but if it’s not, 
> I expect OpenSSL will have to write some code J
>
> [...] 

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo