Subject: [Ipsec] OCSP in IKEv2

From: "Michael Myers" <[email-masked]>
Date: Wed, 19 May 2004 13:24:09 -0700

Charlie,

Recent discussions in the PKI4IPSEC working group exposed a
disconnect between IKE's specification of CRLs and their utility
given likely CRL size.  Towards in-band alternatives, OCSP as
developed by PKIX and defined by RFC 2560 is a viable option for
IKE in-band signaling of certificate revocation status.

OCSP did not exist as an RFC when IKE was originally drafted; it
was still an I-D at that stage of IKE's development. Its absence
in IKE's original specification is thus understandable.  But
OCSP does now exist as an alternative to CRLs.  Per a recent
PKIX poll, there are something like eight independent
implementations of OCSP.

I strongly encourage amendment of IKEv2 to accommodate OCSP.
TLS has already done so, as has the OWA community.  Why not
IPSEC?  I realize this notice is probably too late for -13 but
might consensus could be formed for inclusion in -14 of IKEv2?

Michael Myers

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 21 May 2004 16:20:27 -0700

> might consensus could be formed for inclusion in -14 of IKEv2?

Mike,

I don't mean to be difficult, but in what way do you believe
that TLS has accomodated OCSP, except to the extent to which
it's failed to accomodate CRLs?

-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 21 May 2004 16:20:27 -0700

Mike,

-Ekr

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 21 May 2004 16:46:56 -0700

Eric,

See Section 3.6 of RFC 3546.

http://www.ietf.org/rfc/rfc3546.txt

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of
Eric Rescorla

Mike,

-Ekr

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 21 May 2004 16:46:56 -0700

Eric,

Mike

-----Original Message-----

Mike,

-Ekr