Re: [TLS] draft-ietf-tls-cached-info-14

[Rob Stradling <[e-mail]>]

On 10/04/13 15:02, Piyush Jain wrote:
>> When you say "The position of the value corresponds to the position of
>> certificate in the certificate chain", I presume you're referring to the
>> CachedObject(s) of type "certificate_chain" that the client sends.
> [Piyush] Correct.
>
>>
>> If a client were to send >1 CachedObjects of type "certificate_chain"
>> and >1 "list of Boolean values" CachedObjects, there could be ambiguity
> over
>> which "certificate_chain" is paired with which "list of Boolean values".
>>
>> Would we simply say that the CachedObject(s) of these two types must be
>> sent in the same order?
>> Or would we need to squeeze the "list of Boolean values" into the
>> "certificate_chain" CachedObject type somehow?
>>
>
> [Piyush]
> Either approach would work (it is just different representation of same
> information). However, keeping them separate would be better just because
> implementations may want to support caching of certificate_chain and may not
> want to support caching of OCSP responses.

Agreed.

Also, we'd have to state that the number of "list of Boolean values" 
CachedObjects sent by the client MUST be either i) zero or ii) exactly 
the same as the number of "certificate_chain" CachedObject(s).

> Given that certificate_chain cached object represents a list of certificates
> with strict rules on ordering,  ocsp cached object would be a list with same
> number of entries and same ordering as those of certificate chain.

Agreed.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online