Subject: RE: OCSP request

From: Juergen Brauckmann <[email-masked]>
Date: Wed, 26 Jul 2000 16:40:11 +0200

At 07:20 26.07.00 -0700, Frank Balluffi wrote:
>Juergen,
>
>If by an "expired crypto algorithm" you mean an algorithm that is known to
>be insecure, then it may also not be possible to rely upon signed OCSP
>responses. This sounds like a red herring to me.

Simple example: Certificate from 1990 with 512-bit RSA signature by the CA,
OCSP Response with an up-to-date certificate with 1024 or 2048 bit RSA key. 

You cannot necessarily rely on the 512-bit signature, but you could rely
upon the OCSP response signature.

Juergen
-- 
Juergen Brauckmann             Tel.:  +49 (0)40 / 80 80 26-3 11
TC TrustCenter GmbH            Fax.:  +49 (0)40 / 80 80 26-1 26
Sonninstraße 24-28   	    mailto:[email-masked]
D-20097 Hamburg 		    http://www.trustcenter.de

---

From: Michael Fritscher <[email-masked]>
Date: Wed, 26 Jul 2000 16:52:05 +0200

> upon the OCSP response signature.

The problem in this context is not so much to be able to rely upon the
OCSP response, but rather that you may have a relyable OCSP response on a
certificate that can have been "easily faked" in the meantime...

Michael

-- 
------------------------------------------------------------
| Michael Fritscher	[email-masked]
| Department of Information Systems, New Media
| Vienna University of Economics and Business Administration
| http://wwwi.wu-wien.ac.at/people/Fritscher.html
| "A computer without windows NT is like a fish without a 
|  bicycle."
------------------------------------------------------------

---

From: Juergen Brauckmann <[email-masked]>
Date: Thu, 27 Jul 2000 11:40:42 +0200

>certificate that can have been "easily faked" in the meantime...

And therefore you need trusted, reliable directory services that can
confirm the existence of a certificate, e.g., OCSP with extensions, and
that can give the user a chance to validate that the certificate the
directory service is talking about is the certificate he has (this can be
done by letting the OCSP responder send a hash of the cert in the response).

Juergen

---

From: Stephen Kent <[email-masked]>
Date: Thu, 27 Jul 2000 16:12:34 -0400

>done by letting the OCSP responder send a hash of the cert in the response).

Whenever I hear someone talk about needing to trust directory 
services, I worry. We generally do not want to rely strongly on 
directories, because on can imagine many ways in which directory 
security could be compromised.  The distributed, replicated nature of 
directories increases the potential for compromise of (unsigned) data 
stored there.

Even the model that calls for a certificate to be time stamped as 
part of being stored in a directory entry is questionable, in my 
mind.  The fundamental notion is that a second, presumably 
independent signature has been applied to a cert when stored in this 
fashion.  The independence part of this is a good notion, but it 
might also be achieved by a CA that uses dual, independent crypto 
devices to sign certs in the first place.  Thus the insistence on 
this specific means of ensuring dual signature controls seems unduly 
implementation-specific and seems to ignore other, equivalently good 
means of effecting the same sort of security.

Steve