[TLS] TLS Cached Info Status

["Hannes Tschofenig" <[e-mail]>]

Hi all, 

 

I thought it would be a good idea to let the group know what the status of the TLS Cached Info draft is (since Rob just asked me a few minutes ago). 

 

You may recall that we had a discussion about the ability to not only cache a single OCSP response (as defined with RFC 6066) but also OCSP responses of intermediate CA certs, which is functionality http://datatracker.ietf.org/doc/draft-ietf-tls-multiple-cert-status-extension/" rel="nofollow">http://datatracker.ietf.org/doc/draft-ietf-tls-multiple-cert-status-extension/ provides. Rob raised this issue in his review, see http://www.ietf.org/mail-archive/web/tls/current/msg09352.html" rel="nofollow">http://www.ietf.org/mail-archive/web/tls/current/msg09352.html. 

 

To me it sounds reasonable to add the requested functionality and the pros & cons had been discussed on the list. 

 

When I met Ekr at the recent NIST workshop we briefly spoke about the TLS Cached Info document and how to progress it. He came up with the idea to use the Firefox telemetry feature to gather some data so that we can estimage the cache hit/miss ratio. With data we would obviously be in a much better position to make an informed decision. 

 

I hope that we get that data soon. If we cannot get it then we have to switch to plan B. 
 

Ciao
Hannes