Subject: [Ipsec] Re: Ipsec Digest, Vol 23, Issue 7

From: " 杜春燕(DU Chun-yan)" <[email-masked]>
Date: Thu, 30 Mar 2006 18:35:16 +0800

>> 	Then here is my question,
>> 	(1)what is the meaning of "in-band" and "out-of-band" in IKE exchange? Give some examples? 
>
>"in-band" -> sent on the wire in the same protocol's messages.
>
>"out-of-band" -> each peer gets the CRL for the other's cert via some
>                 means other than from the other peer in IKE messages,
>		 usually by talking HTTP to a CRL DP.
>
>> 	(2)Does OOB needs to use IPsec/IKE to access to CRLs?
>
>A host might have to use IPsec to talk to a CRL DP; I suspect this is
>not usually the case.
>
>> 	                                                      Then how
>> 	does it cause network access deadlock?
>
>I'm not sure that having to talk IPsec to a CRL DP causes deadlocks, but
>proxies and firewalls and what not might.
>
>Nico
>-- 
>
	Thank you for reply! Are there any more views? 
	
	Question 3: What do OCSP Responder Hash and OCSP Response on earth present for? 
	I think OCSP Responder Hash is used for the sender to notify the receiver which OCSP Responder it trusts, just like the function of Certificate Authority in CERTREQ payload. It is the receiver's duty to form an OCSP request to the OCSP Responder. After getting the OCSP response, the receiver has to form and transmit OCSP Response CERT payload. According to the OCSP Response CERT, the other peer may abort the IKEv2 exchange if it indicates the certificate is revoked or OCSP error. Is it true?
	If this is the case, then I confused that why the receiver still sends the certificate in CERT and OCSP Responder CERT now that the OCSP response CERT indicates that certificate is revoked or OCSP error, should it abort the exchange then? Moreover, how to deal with the "try later" OCSP response?     

    Thanks for help!
	
Regards,			 
　　　　　　　    DU Chun-yan
　　　　　　　　[email-masked]
　　　　　　　　　　2006-03-30

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec