Diff: rfc9654.original

	rfc9654.original	rfc9654.txt


	Internet Engineering Task Force H. Sharma, Ed.	Internet Engineering Task Force (IETF) H. Sharma, Ed.
	Internet-Draft Netskope Inc	Request for Comments: 9654 Netskope Inc
	Obsoletes: 8954 (if approved) 22 May 2024	Obsoletes: 8954 August 2024
	Updates: 6960 (if approved)	Updates: 6960
	Intended status: Standards Track	Category: Standards Track
	Expires: 23 November 2024	ISSN: 2070-1721

	Online Certificate Status Protocol (OCSP) Nonce Extension	Online Certificate Status Protocol (OCSP) Nonce Extension

	draft-ietf-lamps-ocsp-nonce-update-11

	Abstract	Abstract


	RFC 8954 imposed the size constraints on the optional Nonce extension	RFC 8954 imposed size constraints on the optional Nonce extension for
	for the Online Certificate Status Protocol (OCSP). OCSP is used for	the Online Certificate Status Protocol (OCSP). OCSP is used to check
	checking the status of a certificate, and the Nonce extension is used	the status of a certificate, and the Nonce extension is used to
	to cryptographically bind an OCSP response message to a particular	cryptographically bind an OCSP response message to a particular OCSP
	OCSP request message.	request message.

	Some environments use cryptographic algorithms that generate a Nonce	Some environments use cryptographic algorithms that generate a Nonce
	value that is longer than 32 octets. This document updates the	value that is longer than 32 octets. This document updates the
	maximum allowed length of Nonce to 128 octets. This document also	maximum allowed length of Nonce to 128 octets. This document also

	modifies Nonce section to clearly define the encoding format and	modifies the Nonce section to clearly define the encoding format and
	values distinctively for an easier implementation and understanding.	values distinctively for easier implementation and understanding.
	This document obsoletes RFC 8954 and provides updated ASN.1 modules	This document obsoletes RFC 8954 and provides updated ASN.1 modules
	for OCSP, updates RFC 6960.	for OCSP, updates RFC 6960.

	Status of This Memo	Status of This Memo


	This Internet-Draft is submitted in full conformance with the	This is an Internet Standards Track document.
	provisions of BCP 78 and BCP 79.

	Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.


	Internet-Drafts are draft documents valid for a maximum of six months	This document is a product of the Internet Engineering Task Force
	and may be updated, replaced, or obsoleted by other documents at any	(IETF). It represents the consensus of the IETF community. It has
	time. It is inappropriate to use Internet-Drafts as reference	received public review and has been approved for publication by the
	material or to cite them other than as "work in progress."	Internet Engineering Steering Group (IESG). Further information on
		Internet Standards is available in Section 2 of RFC 7841.


	This Internet-Draft will expire on 23 November 2024.	Information about the current status of this document, any errata,
		and how to provide feedback on it may be obtained at
		https://www.rfc-editor.org/info/rfc9654.

	Copyright Notice	Copyright Notice

	Copyright (c) 2024 IETF Trust and the persons identified as the	Copyright (c) 2024 IETF Trust and the persons identified as the
	document authors. All rights reserved.	document authors. All rights reserved.

	This document is subject to BCP 78 and the IETF Trust's Legal	This document is subject to BCP 78 and the IETF Trust's Legal

	Provisions Relating to IETF Documents (https://trustee.ietf.org/	Provisions Relating to IETF Documents
	license-info) in effect on the date of publication of this document.	(https://trustee.ietf.org/license-info) in effect on the date of
	Please review these documents carefully, as they describe your rights	publication of this document. Please review these documents
	and restrictions with respect to this document. Code Components	carefully, as they describe your rights and restrictions with respect
	extracted from this document must include Revised BSD License text as	to this document. Code Components extracted from this document must
	described in Section 4.e of the Trust Legal Provisions and are	include Revised BSD License text as described in Section 4.e of the
	provided without warranty as described in the Revised BSD License.	Trust Legal Provisions and are provided without warranty as described
		in the Revised BSD License.

	Table of Contents	Table of Contents


	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2	1. Introduction
	1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2	1.1. Requirements Language
	2. OCSP Extensions . . . . . . . . . . . . . . . . . . . . . . . 3	2. OCSP Extensions
	2.1. Nonce Extension . . . . . . . . . . . . . . . . . . . . . 3	2.1. Nonce Extension
	3. Security Considerations . . . . . . . . . . . . . . . . . . . 4	3. Security Considerations
	3.1. Replay Attack . . . . . . . . . . . . . . . . . . . . . . 4	3.1. Replay Attack
	4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5	4. IANA Considerations
	Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 5	5. References
	References . . . . . . . . . . . . . . . . . . . . . . . . . . . 5	5.1. Normative References
	Normative References . . . . . . . . . . . . . . . . . . . . . 5	5.2. Informative References
	Informative References . . . . . . . . . . . . . . . . . . . . 6	Appendix A. ASN.1 Modules
	Appendix A. ASN.1 Modules . . . . . . . . . . . . . . . . . . . 6	A.1. OCSP in ASN.1 - 1998 Syntax
	A.1. OCSP in ASN.1 - 1998 Syntax . . . . . . . . . . . . . . . 6	A.2. OCSP in ASN.1 - 2008 Syntax
	A.2. OCSP in ASN.1 - 2008 Syntax . . . . . . . . . . . . . . . 10	Acknowledgements
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 14	Author's Address

	1. Introduction	1. Introduction


	Nonce extension was previously defined in Section 4.4.1 of [RFC6960].	The Nonce extension was previously defined in Section 4.4.1 of
	The Nonce cryptographically binds an OCSP request and a response. It	[RFC6960]. The Nonce cryptographically binds an OCSP request and a
	guarantees the freshness of an OCSP response and to avoid replay	response. It guarantees the freshness of an OCSP response and avoids
	attacks. This extension was updated in [RFC8954]. [RFC8954] limits	replay attacks. This extension was updated in [RFC8954]. [RFC8954]
	the maximum Nonce length to 32 octets. To support cryptographic	limits the maximum Nonce length to 32 octets. To support
	algorithms that generate a Nonce that is longer than 32 octets, this	cryptographic algorithms that generate a Nonce that is longer than 32
	document updates the maximum allowed size of the Nonce to 128 octets.	octets, this document updates the maximum allowed size of the Nonce
	In addition, this document recommends that the OCSP requester and	to 128 octets. In addition, this document recommends that the OCSP
	responder use a Nonce with a minimum length of 32 octets.	requester and responder use a Nonce with a minimum length of 32
		octets.

	1.1. Requirements Language	1.1. Requirements Language

	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and	"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and

	"OPTIONAL" in this document are to be interpreted as described in BCP	"OPTIONAL" in this document are to be interpreted as described in
	14 [RFC2119] [RFC8174] when, and only when, they appear in all	BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
	capitals, as shown here.	capitals, as shown here.

	2. OCSP Extensions	2. OCSP Extensions

	The message formats for OCSP requests and responses are defined in	The message formats for OCSP requests and responses are defined in

	[RFC6960] and Nonce extension was updated in [RFC8954]. [RFC6960]	[RFC6960] and the Nonce extension was updated in [RFC8954].
	also defines the standard extensions for OCSP messages based on the	[RFC6960] also defines the standard extensions for OCSP messages
	extension model employed in X.509 version 3 certificates (see	based on the extension model employed in X.509 version 3 certificates
	[RFC5280]). [RFC8954] replaces this section to limit the minimum and	(see [RFC5280]). [RFC8954] replaces this section to limit the
	maximum length for the Nonce value. This document extends the	minimum and maximum length for the Nonce value. This document
	maximum allowed nonce length to 128 octets and does not change the	extends the maximum allowed nonce length to 128 octets and does not
	specifications of any of the other standard extensions defined in	change the specifications of any of the other extensions defined in
	[RFC6960].	[RFC6960].

	2.1. Nonce Extension	2.1. Nonce Extension

	The Nonce cryptographically binds a request and a response to prevent	The Nonce cryptographically binds a request and a response to prevent
	replay attacks. The Nonce is included as one of the	replay attacks. The Nonce is included as one of the

	requestExtensions in requests; in responses, it would be included as	requestExtensions in requests; in responses, it is included as one of
	one of the responseExtensions. In both the request and the response,	the responseExtensions. In both the request and the response, the
	the Nonce will be identified by the object identifier id-pkix-ocsp-	Nonce is identified by the object identifier id-pkix-ocsp-nonce,
	nonce, while the extnValue is the encoded value of Nonce. If the	while the extnValue is the encoded value of Nonce. If the Nonce
	Nonce extension is present, then the length of the Nonce MUST be at	extension is present, then the length of the Nonce MUST be at least 1
	least 1 octet and can be up to 128 octets. [RFC8954] compliant	octet and can be up to 128 octets. Implementations compliant with
	implementations will be unable to process nonces generated per the	[RFC8954] will not be able to process nonces generated per the new
	new specification with sizes in excess of the limit of 32 octets that	specification with sizes in excess of the limit (32 octets) specified
	was specified in [RFC8954].	in [RFC8954].


	An OCSP requester that implements this document MUST use a minimum	An OCSP requester that implements the extension in this document MUST
	length of 32 octets for Nonce in the Nonce extension.	use a minimum length of 32 octets for Nonce in the Nonce extension.


	An OCSP responder , supporting the Nonce extension, MUST accept Nonce	An OCSP responder that supports the Nonce extension MUST accept Nonce
	lengths of at least 16 octets and up to and including 32 octets.	lengths of at least 16 octets and up to and including 32 octets. A
	Responder MAY choose to respond without the Nonce extension for	responder MAY choose to respond without the Nonce extension for
	requests where the length of the Nonce is in between 1 octet and 15	requests in which the length of the Nonce is in between 1 octet and
	octets or 33 octets and 128 octets.	15 octets or 33 octets and 128 octets.


	Responders, that implements this document MUST reject any OCSP	Responders that implement the extension in this document MUST reject
	request that has a Nonce with a length of either 0 octets or more	any OCSP request that has a Nonce with a length of either 0 octets or
	than 128 octets, with the malformedRequest OCSPResponseStatus as	greater than 128 octets, with the malformedRequest OCSPResponseStatus
	described in Section 4.2.1 of [RFC6960].	as described in Section 4.2.1 of [RFC6960].

	The value of the Nonce MUST be generated using a cryptographically	The value of the Nonce MUST be generated using a cryptographically
	strong pseudorandom number generator (see [RFC4086]). The minimum	strong pseudorandom number generator (see [RFC4086]). The minimum
	Nonce length of 1 octet is defined to provide backward compatibility	Nonce length of 1 octet is defined to provide backward compatibility

	with older OCSP requester that follow [RFC6960].	with older OCSP requesters that follow [RFC6960].

	id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp }	id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp }
	id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }	id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
	Nonce ::= OCTET STRING(SIZE(1..128))	Nonce ::= OCTET STRING(SIZE(1..128))

	Example of an encoded OCSP Nonce extension with 32 octet Nonce in
	hexadecimal format.


	30 2f 06 09 2b 06 01 05 05 07 30 01 02 04 22 04	The following is an example of an encoded OCSP Nonce extension with a
	20 dd 49 d4 07 2c 44 9d a1 c3 17 bd 1c 1b df fe	32-octet Nonce in hexadecimal format.
	db e1 50 31 2e c4 cd 0a dd 18 e5 bd 6f 84 bf 14
	c8


	Here is the decoded version of the above example.	30 2f 06 09 2b 06 01 05 05 07 30 01 02 04 22 04
	Offset, Length and Object Identifier are in decimal.	20 dd 49 d4 07 2c 44 9d a1 c3 17 bd 1c 1b df fe
		db e1 50 31 2e c4 cd 0a dd 18 e5 bd 6f 84 bf 14
		c8

		Here is the decoded version of the above example. Offset, Length,
		and Object Identifier are in decimal.

	Offset Length	Offset Length
	0 47 : SEQUENCE {	0 47 : SEQUENCE {
	2 9 : OBJECT IDENTIFIER ocspNonce (1 3 6 1 5 5 7 48 1 2)	2 9 : OBJECT IDENTIFIER ocspNonce (1 3 6 1 5 5 7 48 1 2)
	13 34 : OCTET STRING, encapsulates {	13 34 : OCTET STRING, encapsulates {
	15 32 : OCTET STRING	15 32 : OCTET STRING
	: DD 49 D4 07 2C 44 9D A1 C3 17 BD 1C 1B DF FE DB	: DD 49 D4 07 2C 44 9D A1 C3 17 BD 1C 1B DF FE DB
	: E1 50 31 2E C4 CD 0A DD 18 E5 BD 6F 84 BF 14 C8	: E1 50 31 2E C4 CD 0A DD 18 E5 BD 6F 84 BF 14 C8
	: }	: }
	: }	: }

	3. Security Considerations	3. Security Considerations

	The security considerations of OCSP, in general, are described in	The security considerations of OCSP, in general, are described in
	[RFC6960]. During the interval in which the previous OCSP response	[RFC6960]. During the interval in which the previous OCSP response
	for a certificate is not expired but the responder has a changed	for a certificate is not expired but the responder has a changed
	status for that certificate, a copy of that OCSP response can be used	status for that certificate, a copy of that OCSP response can be used
	to indicate that the status of the certificate is still valid.	to indicate that the status of the certificate is still valid.

	Including a requester's nonce value in the OCSP response makes sure	Including a requester's nonce value in the OCSP response ensures that
	that the response is the latest response from the server and not an	the response is the most recent response from the server and not an
	old copy.	old copy.

	3.1. Replay Attack	3.1. Replay Attack

	The Nonce extension is used to avoid replay attacks. Since the OCSP	The Nonce extension is used to avoid replay attacks. Since the OCSP
	responder may choose not to send the Nonce extension in the OCSP	responder may choose not to send the Nonce extension in the OCSP
	response even if the requester has sent the Nonce extension in the	response even if the requester has sent the Nonce extension in the
	request [RFC5019], an on-path attacker can intercept the OCSP request	request [RFC5019], an on-path attacker can intercept the OCSP request
	and respond with an earlier response from the server without the	and respond with an earlier response from the server without the
	Nonce extension. This can be mitigated by configuring the server to	Nonce extension. This can be mitigated by configuring the server to
	use a short time interval between the thisUpdate and nextUpdate	use a short time interval between the thisUpdate and nextUpdate
	fields in the OCSP response.	fields in the OCSP response.

	4. IANA Considerations	4. IANA Considerations


	For the ASN.1 Module in Appendix A.1, IANA is requested to assign an	For the ASN.1 modules in Appendixes A.1 and A.2, IANA has assigned
	object identifier (OID) for the module identifier to replace TBD1.	the following object identifiers (OIDs) in the "SMI Security for PKIX
	The OID for the module should be allocated in the "SMI Security for	Module Identifier" registry (1.3.6.1.5.5.7.0):
	PKIX Module Identifier" registry (1.3.6.1.5.5.7.0), and the
	Description for the new OID should be set to "id-mod-ocsp-2024-88".

	For the ASN.1 Module in Appendix A.2, IANA is requested to assign an
	object identifier (OID) for the module identifier to replace TBD2.
	The OID for the module should be allocated in the "SMI Security for
	PKIX Module Identifier" registry (1.3.6.1.5.5.7.0), and the
	Description for the new OID should be set to "id-mod-ocsp-2024-08".

	Acknowledgements


	The authors of this document wish to thank Mohit Sahni for his work	+=======+=====================+
	to produce [RFC8954].	\| Value \| Description \|
		+=======+=====================+
		\| 111 \| id-mod-ocsp-2024-88 \|
		+-------+---------------------+
		\| 112 \| id-mod-ocsp-2024-08 \|
		+-------+---------------------+


	The authors wish to thank Russ Housley, Corey Bonnell, Michael	Table 1
	StJohns and Carl Wallace for the feedback and suggestions.


	References	5. References


	Normative References	5.1. Normative References

	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119,	Requirement Levels", BCP 14, RFC 2119,
	DOI 10.17487/RFC2119, March 1997,	DOI 10.17487/RFC2119, March 1997,
	<https://www.rfc-editor.org/info/rfc2119>.	<https://www.rfc-editor.org/info/rfc2119>.

	[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker,	[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker,
	"Randomness Requirements for Security", BCP 106, RFC 4086,	"Randomness Requirements for Security", BCP 106, RFC 4086,
	DOI 10.17487/RFC4086, June 2005,	DOI 10.17487/RFC4086, June 2005,
	<https://www.rfc-editor.org/info/rfc4086>.	<https://www.rfc-editor.org/info/rfc4086>.

	skipping to change at page 6, line 19 ¶	skipping to change at line 242 ¶
	<https://www.rfc-editor.org/info/rfc6960>.	<https://www.rfc-editor.org/info/rfc6960>.

	[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC	[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
	2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,	2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
	May 2017, <https://www.rfc-editor.org/info/rfc8174>.	May 2017, <https://www.rfc-editor.org/info/rfc8174>.

	[RFC8954] Sahni, M., Ed., "Online Certificate Status Protocol (OCSP)	[RFC8954] Sahni, M., Ed., "Online Certificate Status Protocol (OCSP)
	Nonce Extension", RFC 8954, DOI 10.17487/RFC8954, November	Nonce Extension", RFC 8954, DOI 10.17487/RFC8954, November
	2020, <https://www.rfc-editor.org/info/rfc8954>.	2020, <https://www.rfc-editor.org/info/rfc8954>.


	Informative References	5.2. Informative References

		[Err5891] RFC Errata, Erratum ID 5891, RFC 6960,
		<https://www.rfc-editor.org/errata/eid5891>.

	[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the	[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the
	Public Key Infrastructure Using X.509 (PKIX)", RFC 5912,	Public Key Infrastructure Using X.509 (PKIX)", RFC 5912,
	DOI 10.17487/RFC5912, June 2010,	DOI 10.17487/RFC5912, June 2010,
	<https://www.rfc-editor.org/info/rfc5912>.	<https://www.rfc-editor.org/info/rfc5912>.


	[Errata5891]
	RFC Errata, Erratum ID 5891, RFC 6960,
	<https://www.rfc-editor.org/errata/eid5891>.

	Appendix A. ASN.1 Modules	Appendix A. ASN.1 Modules

	This section includes the ASN.1 modules for OCSP and replaces the	This section includes the ASN.1 modules for OCSP and replaces the

	entirity of Section 5 of [RFC8954]. It addresses Errata id 5891	entirety of Section 5 of [RFC8954]. It addresses Errata ID 5891
	[Errata5891] as well.	[Err5891] as well.

	Appendix A.1 includes an ASN.1 module that conforms to the 1998	Appendix A.1 includes an ASN.1 module that conforms to the 1998
	version of ASN.1 for all syntax elements of OCSP. This module	version of ASN.1 for all syntax elements of OCSP. This module

	replaces the modules Appendix B.1 of [RFC6960].	replaces the module in Appendix B.1 of [RFC6960].

	Appendix A.2 includes an ASN.1 module, corresponding to the module	Appendix A.2 includes an ASN.1 module, corresponding to the module

	present in A.1, that conforms to the 2008 version of ASN.1. This	present in Appendix A.1, that conforms to the 2008 version of ASN.1.
	module replaces the modules in Section 4 of [RFC5912] and	This module replaces the modules in Section 4 of [RFC5912] and
	Appendix B.2 of [RFC6960]. Although a 2008 ASN.1 module is provided,	Appendix B.2 of [RFC6960]. Although a 2008 ASN.1 module is provided,

	the module in Appendix A.1 remains the normative module as per the	the module in Appendix A.1 remains the normative module per the
	policy of the PKIX working group.	policy of the PKIX Working Group.

	A.1. OCSP in ASN.1 - 1998 Syntax	A.1. OCSP in ASN.1 - 1998 Syntax

	OCSP-2024-88
	{iso(1) identified-organization(3) dod(6) internet(1)
	security(5) mechanisms(5) pkix(7) id-mod(0)
	id-mod-ocsp-2024-88(TBD1)}


	DEFINITIONS EXPLICIT TAGS ::=	OCSP-2024-88
		{iso(1) identified-organization(3) dod(6) internet(1)
		security(5) mechanisms(5) pkix(7) id-mod(0)
		id-mod-ocsp-2024-88(111)}


	BEGIN	DEFINITIONS EXPLICIT TAGS ::=


	IMPORTS	BEGIN


	-- PKIX Certificate Extensions	IMPORTS
	AuthorityInfoAccessSyntax, CRLReason, GeneralName
	FROM PKIX1Implicit88 { iso(1) identified-organization(3)
	dod(6) internet(1) security(5) mechanisms(5) pkix(7)
	id-mod(0) id-pkix1-implicit(19) }


	Name, CertificateSerialNumber, Extensions,	-- PKIX Certificate Extensions
	id-kp, id-ad-ocsp, Certificate, AlgorithmIdentifier	AuthorityInfoAccessSyntax, CRLReason, GeneralName
	FROM PKIX1Explicit88 { iso(1) identified-organization(3)	FROM PKIX1Implicit88 { iso(1) identified-organization(3)
	dod(6) internet(1) security(5) mechanisms(5) pkix(7)	dod(6) internet(1) security(5) mechanisms(5) pkix(7)
	id-mod(0) id-pkix1-explicit(18) };	id-mod(0) id-pkix1-implicit(19) }


	OCSPRequest ::= SEQUENCE {	Name, CertificateSerialNumber, Extensions,
	tbsRequest TBSRequest,	id-kp, id-ad-ocsp, Certificate, AlgorithmIdentifier
	optionalSignature [0] EXPLICIT Signature OPTIONAL }	FROM PKIX1Explicit88 { iso(1) identified-organization(3)
		dod(6) internet(1) security(5) mechanisms(5) pkix(7)
		id-mod(0) id-pkix1-explicit(18) };


	TBSRequest ::= SEQUENCE {	OCSPRequest ::= SEQUENCE {
	version [0] EXPLICIT Version DEFAULT v1,	tbsRequest TBSRequest,
	requestorName [1] EXPLICIT GeneralName OPTIONAL,	optionalSignature [0] EXPLICIT Signature OPTIONAL }
	requestList SEQUENCE OF Request,
	requestExtensions [2] EXPLICIT Extensions OPTIONAL }


	Signature ::= SEQUENCE {	TBSRequest ::= SEQUENCE {
	signatureAlgorithm AlgorithmIdentifier,	version [0] EXPLICIT Version DEFAULT v1,
	signature BIT STRING,	requestorName [1] EXPLICIT GeneralName OPTIONAL,
	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }	requestList SEQUENCE OF Request,
		requestExtensions [2] EXPLICIT Extensions OPTIONAL }


	Version ::= INTEGER { v1(0) }	Signature ::= SEQUENCE {
		signatureAlgorithm AlgorithmIdentifier,
		signature BIT STRING,
		certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }


	Nonce ::= OCTET STRING(SIZE(1..128))	Version ::= INTEGER { v1(0) }


	Request ::= SEQUENCE {	Nonce ::= OCTET STRING(SIZE(1..128))
	reqCert CertID,
	singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }


	CertID ::= SEQUENCE {	Request ::= SEQUENCE {
	hashAlgorithm AlgorithmIdentifier,	reqCert CertID,
	issuerNameHash OCTET STRING, -- Hash of issuer's DN	singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
	issuerKeyHash OCTET STRING, -- Hash of issuer's public key
	serialNumber CertificateSerialNumber }


	OCSPResponse ::= SEQUENCE {	CertID ::= SEQUENCE {
	responseStatus OCSPResponseStatus,	hashAlgorithm AlgorithmIdentifier,
	responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }	issuerNameHash OCTET STRING, -- Hash of issuer's DN
		issuerKeyHash OCTET STRING, -- Hash of issuer's public key
		serialNumber CertificateSerialNumber }


	OCSPResponseStatus ::= ENUMERATED {	OCSPResponse ::= SEQUENCE {
	successful (0), -- Response has valid confirmations	responseStatus OCSPResponseStatus,
	malformedRequest (1), -- Illegal confirmation request	responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }
	internalError (2), -- Internal error in issuer
	tryLater (3), -- Try again later
	-- (4) is not used
	sigRequired (5), -- Must sign the request
	unauthorized (6) -- Request unauthorized
	}


	ResponseBytes ::= SEQUENCE {	OCSPResponseStatus ::= ENUMERATED {
	responseType OBJECT IDENTIFIER,	successful (0), -- Response has valid confirmations
	response OCTET STRING }	malformedRequest (1), -- Illegal confirmation request
		internalError (2), -- Internal error in issuer
		tryLater (3), -- Try again later
		-- (4) is not used
		sigRequired (5), -- Must sign the request
		unauthorized (6) -- Request unauthorized
		}


	BasicOCSPResponse ::= SEQUENCE {	ResponseBytes ::= SEQUENCE {
	tbsResponseData ResponseData,	responseType OBJECT IDENTIFIER,
	signatureAlgorithm AlgorithmIdentifier,	response OCTET STRING }
	signature BIT STRING,
	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }


	ResponseData ::= SEQUENCE {	BasicOCSPResponse ::= SEQUENCE {
	version [0] EXPLICIT Version DEFAULT v1,	tbsResponseData ResponseData,
	responderID ResponderID,	signatureAlgorithm AlgorithmIdentifier,
	producedAt GeneralizedTime, -- The format for	signature BIT STRING,
	-- GeneralizedTime is as	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
	-- specified in Section
	-- 4.1.2.5.2 of [RFC5280]
	responses SEQUENCE OF SingleResponse,
	responseExtensions [1] EXPLICIT Extensions OPTIONAL }


	ResponderID ::= CHOICE {	ResponseData ::= SEQUENCE {
	byName [1] Name,	version [0] EXPLICIT Version DEFAULT v1,
	byKey [2] KeyHash }	responderID ResponderID,
		producedAt GeneralizedTime, -- The format for
		-- GeneralizedTime is as
		-- specified in Section
		-- 4.1.2.5.2 of [RFC5280]
		responses SEQUENCE OF SingleResponse,
		responseExtensions [1] EXPLICIT Extensions OPTIONAL }


	KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key	ResponderID ::= CHOICE {
	-- (i.e., the SHA-1 hash of the value of the	byName [1] Name,
	-- BIT STRING subjectPublicKey [excluding	byKey [2] KeyHash }
	-- the tag, length, and number of unused
	-- bits] in the responder's certificate)


	SingleResponse ::= SEQUENCE {	KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
	certID CertID,	-- (i.e., the SHA-1 hash of the value of the
	certStatus CertStatus,	-- BIT STRING subjectPublicKey [excluding
	thisUpdate GeneralizedTime,	-- the tag, length, and number of unused
	nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,	-- bits] in the responder's certificate)
	singleExtensions [1] EXPLICIT Extensions OPTIONAL }


	CertStatus ::= CHOICE {	SingleResponse ::= SEQUENCE {
	good [0] IMPLICIT NULL,	certID CertID,
	revoked [1] IMPLICIT RevokedInfo,	certStatus CertStatus,
	unknown [2] IMPLICIT UnknownInfo }	thisUpdate GeneralizedTime,
		nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
		singleExtensions [1] EXPLICIT Extensions OPTIONAL }


	RevokedInfo ::= SEQUENCE {	CertStatus ::= CHOICE {
	revocationTime GeneralizedTime,	good [0] IMPLICIT NULL,
	revocationReason [0] EXPLICIT CRLReason OPTIONAL }	revoked [1] IMPLICIT RevokedInfo,
		unknown [2] IMPLICIT UnknownInfo }


	UnknownInfo ::= NULL	RevokedInfo ::= SEQUENCE {
		revocationTime GeneralizedTime,
		revocationReason [0] EXPLICIT CRLReason OPTIONAL }


	ArchiveCutoff ::= GeneralizedTime	UnknownInfo ::= NULL


	AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER	ArchiveCutoff ::= GeneralizedTime


	ServiceLocator ::= SEQUENCE {	AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER
	issuer Name,
	locator AuthorityInfoAccessSyntax }


	CrlID ::= SEQUENCE {	ServiceLocator ::= SEQUENCE {
	crlUrl [0] EXPLICIT IA5String OPTIONAL,	issuer Name,
	crlNum [1] EXPLICIT INTEGER OPTIONAL,	locator AuthorityInfoAccessSyntax }
	crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }


	PreferredSignatureAlgorithms ::= SEQUENCE OF PreferredSignatureAlgorithm	CrlID ::= SEQUENCE {
		crlUrl [0] EXPLICIT IA5String OPTIONAL,
		crlNum [1] EXPLICIT INTEGER OPTIONAL,
		crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }


	PreferredSignatureAlgorithm ::= SEQUENCE {	PreferredSignatureAlgorithms ::= SEQUENCE OF PreferredSignatureAlgorithm
	sigIdentifier AlgorithmIdentifier,
	certIdentifier AlgorithmIdentifier OPTIONAL }


		PreferredSignatureAlgorithm ::= SEQUENCE {
		sigIdentifier AlgorithmIdentifier,
		certIdentifier AlgorithmIdentifier OPTIONAL }


	id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }	-- Object Identifiers
	id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp }
	id-pkix-ocsp-basic OBJECT IDENTIFIER ::= { id-pkix-ocsp 1 }
	id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
	id-pkix-ocsp-crl OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 }
	id-pkix-ocsp-response OBJECT IDENTIFIER ::= { id-pkix-ocsp 4 }
	id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
	id-pkix-ocsp-archive-cutoff OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }
	id-pkix-ocsp-service-locator OBJECT IDENTIFIER ::= { id-pkix-ocsp 7 }
	id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }
	id-pkix-ocsp-extended-revoke OBJECT IDENTIFIER ::= { id-pkix-ocsp 9 }


	END	id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
		id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp }
		id-pkix-ocsp-basic OBJECT IDENTIFIER ::= { id-pkix-ocsp 1 }
		id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
		id-pkix-ocsp-crl OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 }
		id-pkix-ocsp-response OBJECT IDENTIFIER ::= { id-pkix-ocsp 4 }
		id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
		id-pkix-ocsp-archive-cutoff OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }
		id-pkix-ocsp-service-locator OBJECT IDENTIFIER ::= { id-pkix-ocsp 7 }
		id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }
		id-pkix-ocsp-extended-revoke OBJECT IDENTIFIER ::= { id-pkix-ocsp 9 }

		END

	A.2. OCSP in ASN.1 - 2008 Syntax	A.2. OCSP in ASN.1 - 2008 Syntax


	OCSP-2024-08	OCSP-2024-08
	{iso(1) identified-organization(3) dod(6) internet(1)	{iso(1) identified-organization(3) dod(6) internet(1)
	security(5) mechanisms(5) pkix(7) id-mod(0)	security(5) mechanisms(5) pkix(7) id-mod(0)
	id-mod-ocsp-2024-08(TBD2)}	id-mod-ocsp-2024-08(112)}


	DEFINITIONS EXPLICIT TAGS ::=	DEFINITIONS EXPLICIT TAGS ::=


	BEGIN	BEGIN


	IMPORTS	IMPORTS


	Extensions{}, EXTENSION	Extensions{}, EXTENSION
	FROM PKIX-CommonTypes-2009 -- From [RFC5912]	FROM PKIX-CommonTypes-2009 -- From [RFC5912]
	{iso(1) identified-organization(3) dod(6) internet(1) security(5)	{iso(1) identified-organization(3) dod(6) internet(1) security(5)
	mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)}	mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)}


	AlgorithmIdentifier{}, DIGEST-ALGORITHM, SIGNATURE-ALGORITHM, PUBLIC-KEY	AlgorithmIdentifier{}, DIGEST-ALGORITHM, SIGNATURE-ALGORITHM, PUBLIC-KEY
	FROM AlgorithmInformation-2009 -- From [RFC5912]	FROM AlgorithmInformation-2009 -- From [RFC5912]
	{iso(1) identified-organization(3) dod(6) internet(1) security(5)	{iso(1) identified-organization(3) dod(6) internet(1) security(5)
	mechanisms(5) pkix(7) id-mod(0)	mechanisms(5) pkix(7) id-mod(0)
	id-mod-algorithmInformation-02(58)}	id-mod-algorithmInformation-02(58)}


	AuthorityInfoAccessSyntax, GeneralName, CrlEntryExtensions, CRLReason	AuthorityInfoAccessSyntax, GeneralName, CrlEntryExtensions, CRLReason
	FROM PKIX1Implicit-2009 -- From [RFC5912]	FROM PKIX1Implicit-2009 -- From [RFC5912]
	{iso(1) identified-organization(3) dod(6) internet(1) security(5)	{iso(1) identified-organization(3) dod(6) internet(1) security(5)
	mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}	mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}


	Name, CertificateSerialNumber, id-kp, id-ad-ocsp, Certificate	Name, CertificateSerialNumber, id-kp, id-ad-ocsp, Certificate
	FROM PKIX1Explicit-2009 -- From [RFC5912]	FROM PKIX1Explicit-2009 -- From [RFC5912]
	{iso(1) identified-organization(3) dod(6) internet(1) security(5)	{iso(1) identified-organization(3) dod(6) internet(1) security(5)
	mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}	mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}


	sa-dsaWithSHA1, sa-rsaWithMD2, sa-rsaWithMD5, sa-rsaWithSHA1	sa-dsaWithSHA1, sa-rsaWithMD2, sa-rsaWithMD5, sa-rsaWithSHA1
	FROM PKIXAlgs-2009 -- From [RFC5912]	FROM PKIXAlgs-2009 -- From [RFC5912]
	{iso(1) identified-organization(3) dod(6) internet(1) security(5)	{iso(1) identified-organization(3) dod(6) internet(1) security(5)
	mechanisms(5) pkix(7) id-mod(0)	mechanisms(5) pkix(7) id-mod(0)
	id-mod-pkix1-algorithms2008-02(56)};	id-mod-pkix1-algorithms2008-02(56)};


	OCSPRequest ::= SEQUENCE {	OCSPRequest ::= SEQUENCE {
	tbsRequest TBSRequest,	tbsRequest TBSRequest,
	optionalSignature [0] EXPLICIT Signature OPTIONAL }	optionalSignature [0] EXPLICIT Signature OPTIONAL }


	TBSRequest ::= SEQUENCE {	TBSRequest ::= SEQUENCE {
	version [0] EXPLICIT Version DEFAULT v1,	version [0] EXPLICIT Version DEFAULT v1,
	requestorName [1] EXPLICIT GeneralName OPTIONAL,	requestorName [1] EXPLICIT GeneralName OPTIONAL,
	requestList SEQUENCE OF Request,	requestList SEQUENCE OF Request,
	requestExtensions [2] EXPLICIT Extensions {{re-ocsp-nonce \|	requestExtensions [2] EXPLICIT Extensions {{re-ocsp-nonce \|
	re-ocsp-response, ...,	re-ocsp-response, ...,
	re-ocsp-preferred-signature-algorithms}} OPTIONAL }	re-ocsp-preferred-signature-algorithms}} OPTIONAL }


	Signature ::= SEQUENCE {	Signature ::= SEQUENCE {
	signatureAlgorithm AlgorithmIdentifier	signatureAlgorithm AlgorithmIdentifier
	{ SIGNATURE-ALGORITHM, {...}},	{ SIGNATURE-ALGORITHM, {...}},
	signature BIT STRING,	signature BIT STRING,
	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }


	Version ::= INTEGER { v1(0) }	Version ::= INTEGER { v1(0) }


	Nonce ::= OCTET STRING(SIZE(1..128))	Nonce ::= OCTET STRING(SIZE(1..128))


	Request ::= SEQUENCE {	Request ::= SEQUENCE {
	reqCert CertID,	reqCert CertID,
	singleRequestExtensions [0] EXPLICIT Extensions	singleRequestExtensions [0] EXPLICIT Extensions
	{ {re-ocsp-service-locator,	{ {re-ocsp-service-locator,
	...}} OPTIONAL }	...}} OPTIONAL }


	CertID ::= SEQUENCE {	CertID ::= SEQUENCE {
	hashAlgorithm AlgorithmIdentifier	hashAlgorithm AlgorithmIdentifier
	{DIGEST-ALGORITHM, {...}},	{DIGEST-ALGORITHM, {...}},
	issuerNameHash OCTET STRING, -- Hash of issuer's DN	issuerNameHash OCTET STRING, -- Hash of issuer's DN
	issuerKeyHash OCTET STRING, -- Hash of issuer's public key	issuerKeyHash OCTET STRING, -- Hash of issuer's public key
	serialNumber CertificateSerialNumber }	serialNumber CertificateSerialNumber }


	OCSPResponse ::= SEQUENCE {	OCSPResponse ::= SEQUENCE {
	responseStatus OCSPResponseStatus,	responseStatus OCSPResponseStatus,
	responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }	responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }


	OCSPResponseStatus ::= ENUMERATED {	OCSPResponseStatus ::= ENUMERATED {
	successful (0), -- Response has valid confirmations	successful (0), -- Response has valid confirmations
	malformedRequest (1), -- Illegal confirmation request	malformedRequest (1), -- Illegal confirmation request
	internalError (2), -- Internal error in issuer	internalError (2), -- Internal error in issuer
	tryLater (3), -- Try again later	tryLater (3), -- Try again later
	-- (4) is not used	-- (4) is not used
	sigRequired (5), -- Must sign the request	sigRequired (5), -- Must sign the request
	unauthorized (6) -- Request unauthorized	unauthorized (6) -- Request unauthorized
	}	}


	RESPONSE ::= TYPE-IDENTIFIER	RESPONSE ::= TYPE-IDENTIFIER


	ResponseSet RESPONSE ::= {basicResponse, ...}	ResponseSet RESPONSE ::= {basicResponse, ...}


	ResponseBytes ::= SEQUENCE {	ResponseBytes ::= SEQUENCE {
	responseType RESPONSE.	responseType RESPONSE.
	&id ({ResponseSet}),	&id ({ResponseSet}),
	response OCTET STRING (CONTAINING RESPONSE.	response OCTET STRING (CONTAINING RESPONSE.
	&Type({ResponseSet}{@responseType}))}	&Type({ResponseSet}{@responseType}))}


	basicResponse RESPONSE ::=	basicResponse RESPONSE ::=
	{ BasicOCSPResponse IDENTIFIED BY id-pkix-ocsp-basic }	{ BasicOCSPResponse IDENTIFIED BY id-pkix-ocsp-basic }


	BasicOCSPResponse ::= SEQUENCE {	BasicOCSPResponse ::= SEQUENCE {
	tbsResponseData ResponseData,	tbsResponseData ResponseData,
	signatureAlgorithm AlgorithmIdentifier{SIGNATURE-ALGORITHM,	signatureAlgorithm AlgorithmIdentifier{SIGNATURE-ALGORITHM,
	{sa-dsaWithSHA1 \| sa-rsaWithSHA1 \|	{sa-dsaWithSHA1 \| sa-rsaWithSHA1 \|
	sa-rsaWithMD5 \| sa-rsaWithMD2, ...}},	sa-rsaWithMD5 \| sa-rsaWithMD2, ...}},
	signature BIT STRING,	signature BIT STRING,
	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }	certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }


	ResponseData ::= SEQUENCE {	ResponseData ::= SEQUENCE {
	version [0] EXPLICIT Version DEFAULT v1,	version [0] EXPLICIT Version DEFAULT v1,
	responderID ResponderID,	responderID ResponderID,
	producedAt GeneralizedTime,	producedAt GeneralizedTime,
	responses SEQUENCE OF SingleResponse,	responses SEQUENCE OF SingleResponse,
	responseExtensions [1] EXPLICIT Extensions	responseExtensions [1] EXPLICIT Extensions
	{{re-ocsp-nonce, ...,	{{re-ocsp-nonce, ...,
	re-ocsp-extended-revoke}} OPTIONAL }	re-ocsp-extended-revoke}} OPTIONAL }


	ResponderID ::= CHOICE {	ResponderID ::= CHOICE {
	byName [1] Name,	byName [1] Name,
	byKey [2] KeyHash }	byKey [2] KeyHash }


	KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key	KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
	-- (excluding the tag and length fields)	-- (excluding the tag and length fields)


	SingleResponse ::= SEQUENCE {	SingleResponse ::= SEQUENCE {
	certID CertID,	certID CertID,
	certStatus CertStatus,	certStatus CertStatus,
	thisUpdate GeneralizedTime,	thisUpdate GeneralizedTime,
	nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,	nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
	singleExtensions [1] EXPLICIT Extensions{{re-ocsp-crl \|	singleExtensions [1] EXPLICIT Extensions{{re-ocsp-crl \|
	re-ocsp-archive-cutoff \|	re-ocsp-archive-cutoff \|
	CrlEntryExtensions, ...}	CrlEntryExtensions, ...}
	} OPTIONAL }	} OPTIONAL }


	CertStatus ::= CHOICE {	CertStatus ::= CHOICE {
	good [0] IMPLICIT NULL,	good [0] IMPLICIT NULL,
	revoked [1] IMPLICIT RevokedInfo,	revoked [1] IMPLICIT RevokedInfo,
	unknown [2] IMPLICIT UnknownInfo }	unknown [2] IMPLICIT UnknownInfo }


	RevokedInfo ::= SEQUENCE {	RevokedInfo ::= SEQUENCE {
	revocationTime GeneralizedTime,	revocationTime GeneralizedTime,
	revocationReason [0] EXPLICIT CRLReason OPTIONAL }	revocationReason [0] EXPLICIT CRLReason OPTIONAL }


	UnknownInfo ::= NULL	UnknownInfo ::= NULL


	ArchiveCutoff ::= GeneralizedTime	ArchiveCutoff ::= GeneralizedTime


	AcceptableResponses ::= SEQUENCE OF RESPONSE.&id({ResponseSet})	AcceptableResponses ::= SEQUENCE OF RESPONSE.&id({ResponseSet})


	ServiceLocator ::= SEQUENCE {	ServiceLocator ::= SEQUENCE {
	issuer Name,	issuer Name,
	locator AuthorityInfoAccessSyntax }	locator AuthorityInfoAccessSyntax }


	CrlID ::= SEQUENCE {	CrlID ::= SEQUENCE {
	crlUrl [0] EXPLICIT IA5String OPTIONAL,	crlUrl [0] EXPLICIT IA5String OPTIONAL,
	crlNum [1] EXPLICIT INTEGER OPTIONAL,	crlNum [1] EXPLICIT INTEGER OPTIONAL,
	crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }	crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }


	PreferredSignatureAlgorithms ::= SEQUENCE OF PreferredSignatureAlgorithm	PreferredSignatureAlgorithms ::= SEQUENCE OF PreferredSignatureAlgorithm


	PreferredSignatureAlgorithm ::= SEQUENCE {	PreferredSignatureAlgorithm ::= SEQUENCE {
	sigIdentifier AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}},	sigIdentifier AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}},
	certIdentifier AlgorithmIdentifier{PUBLIC-KEY, {...}} OPTIONAL	certIdentifier AlgorithmIdentifier{PUBLIC-KEY, {...}} OPTIONAL
	}	}


		-- Certificate Extensions


	ext-ocsp-nocheck EXTENSION ::= { SYNTAX NULL IDENTIFIED	ext-ocsp-nocheck EXTENSION ::= { SYNTAX NULL IDENTIFIED
	BY id-pkix-ocsp-nocheck }	BY id-pkix-ocsp-nocheck }


		-- Request Extensions


	re-ocsp-nonce EXTENSION ::= { SYNTAX Nonce	re-ocsp-nonce EXTENSION ::= { SYNTAX Nonce
	IDENTIFIED BY id-pkix-ocsp-nonce }	IDENTIFIED BY id-pkix-ocsp-nonce }


	re-ocsp-response EXTENSION ::= { SYNTAX AcceptableResponses IDENTIFIED	re-ocsp-response EXTENSION ::= { SYNTAX AcceptableResponses IDENTIFIED
	BY id-pkix-ocsp-response }	BY id-pkix-ocsp-response }


	re-ocsp-service-locator EXTENSION ::= { SYNTAX ServiceLocator	re-ocsp-service-locator EXTENSION ::= { SYNTAX ServiceLocator
	IDENTIFIED BY	IDENTIFIED BY
	id-pkix-ocsp-service-locator }	id-pkix-ocsp-service-locator }


	re-ocsp-preferred-signature-algorithms EXTENSION ::= {	re-ocsp-preferred-signature-algorithms EXTENSION ::= {
	SYNTAX PreferredSignatureAlgorithms	SYNTAX PreferredSignatureAlgorithms
	IDENTIFIED BY id-pkix-ocsp-pref-sig-algs }	IDENTIFIED BY id-pkix-ocsp-pref-sig-algs }


		-- Response Extensions


	re-ocsp-crl EXTENSION ::= { SYNTAX CrlID IDENTIFIED BY	re-ocsp-crl EXTENSION ::= { SYNTAX CrlID IDENTIFIED BY
	id-pkix-ocsp-crl }	id-pkix-ocsp-crl }


	re-ocsp-archive-cutoff EXTENSION ::= { SYNTAX ArchiveCutoff	re-ocsp-archive-cutoff EXTENSION ::= { SYNTAX ArchiveCutoff
	IDENTIFIED BY	IDENTIFIED BY
	id-pkix-ocsp-archive-cutoff }	id-pkix-ocsp-archive-cutoff }


	re-ocsp-extended-revoke EXTENSION ::= { SYNTAX NULL IDENTIFIED BY	re-ocsp-extended-revoke EXTENSION ::= { SYNTAX NULL IDENTIFIED BY
	id-pkix-ocsp-extended-revoke }	id-pkix-ocsp-extended-revoke }


		-- Object Identifiers


	id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }	id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
	id-pkix-ocsp OBJECT IDENTIFIER ::= id-ad-ocsp	id-pkix-ocsp OBJECT IDENTIFIER ::= id-ad-ocsp
	id-pkix-ocsp-basic OBJECT IDENTIFIER ::= { id-pkix-ocsp 1 }	id-pkix-ocsp-basic OBJECT IDENTIFIER ::= { id-pkix-ocsp 1 }
	id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }	id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
	id-pkix-ocsp-crl OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 }	id-pkix-ocsp-crl OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 }
	id-pkix-ocsp-response OBJECT IDENTIFIER ::= { id-pkix-ocsp 4 }	id-pkix-ocsp-response OBJECT IDENTIFIER ::= { id-pkix-ocsp 4 }
	id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }	id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
	id-pkix-ocsp-archive-cutoff OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }	id-pkix-ocsp-archive-cutoff OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }
	id-pkix-ocsp-service-locator OBJECT IDENTIFIER ::= { id-pkix-ocsp 7 }	id-pkix-ocsp-service-locator OBJECT IDENTIFIER ::= { id-pkix-ocsp 7 }
	id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }	id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }
	id-pkix-ocsp-extended-revoke OBJECT IDENTIFIER ::= { id-pkix-ocsp 9 }	id-pkix-ocsp-extended-revoke OBJECT IDENTIFIER ::= { id-pkix-ocsp 9 }


	END	END

		Acknowledgements

		The authors of this document thank Mohit Sahni for his work to
		produce [RFC8954].

		The authors also thank Russ Housley, Corey Bonnell, Michael StJohns,
		and Carl Wallace for their feedback and suggestions.

	Author's Address	Author's Address

	Himanshu Sharma (editor)	Himanshu Sharma (editor)
	Netskope Inc	Netskope Inc
	2445 Augustine Dr 3rd floor	2445 Augustine Dr 3rd floor
	Santa Clara, California 95054	Santa Clara, California 95054
	United States of America	United States of America
	Email: himanshu@netskope.com	Email: himanshu@netskope.com
	URI: www.netskope.com	URI: www.netskope.com

End of changes. 115 change blocks.
	403 lines changed or deleted	409 lines changed or added
This html diff was produced by rfcdiff 1.48.