Subject: Re: Matching CertIDs between OCSP requests and responses

From: [email-masked] (Peter Gutmann)
Date: Fri, 16 Mar 2001 05:07:11 (NZDT)

[email-masked] writes:

>Another OCSP (v1) question:  Can a client assume that the OCSP response CertID
>terms will precisely match those from the request?  

I would hope they do, otherwise there's a trivial attack which completely
defeats OCSP:

- You submit a request for a check of cert X (which has been revoked)
- What arrives at the CA is a request for a check of cert Y (which hasn't)
- You get back a response of "OK"

Unless you check the returned ID data there's no way you can detect this.  What
I'm doing is a binary compare of request and response ID data, if they differ I
don't trust the response.

(There's a second, slightly less trivial attack which you can perform if nonces
 aren't used, once I can determine experimentally how well-supported these are
 in practice (the "no critical extensions" requirement in the spec doesn't help
 much with this) I'll see if I can make them mandatory in my code).

Peter.

---

From: Jeff Jacoby <[email-masked]>
Date: Mon, 19 Mar 2001 09:28:38 -0800

Peter, 

[email-masked] wrote:

[snip]

> don't trust the response.

Pardon my naivte, but couldn't the responder apply a different BER/DER
encoding to CertID in its response, yet keeping the actual encoded
values 
within a CertID identical?

Jeff