Subject: [AAA-WG]: [issue] OCSP Support

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Thu, 23 Aug 2001 15:41:05 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-23
Reference: Issue 125 (Inconsistency in OCSP-Responses AVP)
Document: CMS-02
Comment type: T
Priority: S
Section: 
Rationale/Explanation of issue: 

The specification doesn't mention which level of requirement OCSP has.

When reading the specification, I've found that OCSP may be used with
two different purposes:

- Certificate validation in order to decide if a certificate in cache
can be used or not.
- Certificate validation on behalf of other DSA participant.

Although the purposes is different, the implementation would be the
same. However, how mandatory is the OCSP support? The specification
itself only seems to talk about the first purpose (6.3) by saying:

   Optionally, the Diameter node MAY check the status of
   certificates using another mechanism, such as Online Certificate
   Status Protocol (OCSP) [9].

According to this paragraph, OCSP support is optional. However, when
discussing about issue 125, we reached an agreement by which
OCSP-Responses AVP in DSAA is optional.

I've got two concerns:

- Does a Diameter implementation supporting CMS Sec have to support
online and CRL validation functionality? Is it mandatory to support
one, both? Is it optional?
- What happens when after a DSAR requesting an OCSP response arrives
to a Diameter node that doesn't support OCSP? I suppose than no
OCSP-Responses AVP is included in the DSAA, so that the iniciator
deduces that OCSP isn't supported.

Requested change: 

Including a paragraph stating which certificate validation mechanisms
must support a CMS-compliant and how mandatory they are.

Adding a sentence to the first paragraph of page 12 (3.1) saying
something like:

   If the sender of the DSAA does not support OCSP, it would simply
   return a DSAA without any OCSP-Responses AVP.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -