Subject: [AAA-WG]: [issue] Inconsistency in OCSP-Responses AVP

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 20 Aug 2001 14:58:26 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-20
Reference: 
Document: CMS-02
Comment type: T
Priority: S
Section: 3.1, 4.2
Rationale/Explanation of issue: 
The usage scenario chapter states that a DSAA message contains, among
other information:

     - (optionally, if nonce received and OCSP supported) a list of
       OCSP responses for the certificates in question, each of which
       contains the nonce from the DSAR message

However, the format of the DSAA messages indicates that OCSP-Response
AVP is mandatory:

      <DSAA> ::= < Diameter-Header: 304, PXY >
                 ...
               * { OCSP-Responses }
                 ...
Furthermore, the chapter describing OCSP-Responses AVP says the
following:

   The OCSP-Responses AVP [...] contains an OCSP response message from
   an OCSP responder. If the OCSP-Request-Flags AVP indicating a 
   response was required in the corresponding request message, the 
   OCSP-Responses AVP MUST be present. Furthermore, the 
   OCSP-Request-Flags AVP MAY request a fresh OCSP response message,
   which MUST also include the OCSP-Nonce AVP.

Which looks to suggest that if OCSP-Request-Flags AVP in DSAR was
OCSP_RESPONSE or OCSP_FRESH_RESPONSE (with an OCSP-Nonce associated)
there must be an OCSP-Response AVP. But not in the rest of the
possibilities (NO_OCSP_RESPONSE).

Requested change: 
Replace the previous paragraph from usage scenario chapter (3.1) with
this one:

     - (optionally, if OCSP response was required in the DSAR and OCSP
       is supported) a list of OCSP responses for the certificates in
       question. If a fresh response was required and a nonce value
was
       included, each response will contain the nonce from the DSAR
       message

Replace the mandatory field of DSAA in 4.2:

               * { OCSP-Responses }

with an optional field

               * [ OCSP-Responses ]

Regards

  // M.A.