Subject: [AAA-WG]: [issue] OCSP Response request additional text

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Thu, 23 Aug 2001 12:16:21 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-22
Reference: 
Document: CMS-02
Comment type: E
Priority: 2
Section: 3.1
Rationale/Explanation of issue: 

An additional clarifying text might be added to depict the way in
which OCSP responses are required.

Requested change: 

Replace the following paragraph:

   If certificate status (revocation) is an issue for the Diameter
   initiator, then the DSAR message MAY contain a nonce value. The
idea
   is that the sender of the DSAA makes OCSP requests on behalf of the
   Diameter initiator and returns the OCSP responses to the Diameter 
   initiator as part of the DSAR message. The use of the nonce value
   ensures that the sender of the DSAA cannot return cached or
   otherwise fake OCSP responses to the Diameter initiator.

with this one:

   If certificate status is an issue for the Diameter initiator (it
has
   been configured to check if the certificates has not been revoked),
   then the DSAR message MUST contain a flag indicating that it wishes
   to receive certificate status information. The DSAR message MAY
   contain a nonce value (depending on whether the initiator wishes a
   "fresh" response). The idea is that the sender of the DSAA makes
   OCSP requests on behalf of the Diameter initiator and returns the
   OCSP responses to the Diameter node as part of the DSAR message.
The
   use of the nonce value ensures that the sender of the DSAA cannot
   return cached or otherwise fake OCSP responses to the Diameter
node.
   If the initiator indicated that no fresh response was required (so
   that no nonce value was provided) it MAY accept a stale response.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -