Subject: RE: [OCSP] are several requests for different CAs at once valid ?

From: [email-masked] (Peter Gutmann)
Date: Mon, 15 Sep 2003 00:26:24 +1200

"Ryan M. Hurst" <[email-masked]> writes:

>Traditionally OCSP responders generate and sign responses on-demand
>(dynamically), this requires the responders to scale their infrastructure to
>handle very high peak volumes. 

Hmm, biting back my immediate response (that breaking OCSP's security doesn't
seem like a good way to try and get usable performance out of it), why not use
a protocol like RTCS, which was designed from the outset to allow for high-
performance, highly scalable implementations?  It's not called real-time cert
status for nothing (there's one organisation using it for exactly that, they
do a real-time verification of cert validity using live validity data before
each and every use of the cert).

Peter.

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Sun, 14 Sep 2003 11:54:36 -0700

Peter - I really don't think what we are doing is breaking OCSP's security, after all nonce is a optional value in 2560 and the standard already specifically supports response pre-production:

     2.5  Response Pre-production

        OCSP responders MAY pre-produce signed responses specifying the
        status of certificates at a specified time. The time at which the
        status was known to be correct SHALL be reflected in the thisUpdate
        field of the response. The time at or before which newer information
        will be available is reflected in the nextUpdate field, while the
        time at which the response was produced will appear in the producedAt
        field of the response.

And the only way to support this concept within OCSP would be to have the described behavior in regards to nonce handling.

As for why OCSP was chosen over RTCS or a propietary solution, the goal is to work with exiting public infrastrucutres and other third-party solutions; given this OCSP was the obvious solution.

Ryan

From: Peter Gutmann
Sent: Sun 9/14/2003 5:26 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Peter.

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Sun, 14 Sep 2003 15:32:35 -0700

Florian - We certainly recognize the value of a nonce when protecting against replay attacks, but our goal is to support high volume transactions for all of our consumers in the context of the internet transactions and public certification authorities. As such the ability to deal with pre-produced OCSP responses that can be cached and/or distributed to generalized network load distribution centers becomes very important.

As for your request to not require this behavior, this is absolutely what we do; we can validate responses that include a nonce but since our requests won't include one we have nothing to verify them against.

On a side note, I don't think your buying yourself any security if you server is generating a nonce if the request didn't contain one. After all the idea of the nonce is to cryptographically bind a unique request to a unique response and since the client doesn't have anything to compare the nonce to I think you hurt your servers performance without adding any  value. 

As for making this behavior configurable, we can certanly consider this however since we also don't support signed request I don't expect our client to be the client of choice in enviroments that don't allow for such caching schemes.

Ryan

From: Florian Oelmaier
Sent: Sun 9/14/2003 3:13 PM
To: 'Ryan M. Hurst'; 'Peter Gutmann'; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Hello Ryan,

please note: although you are not sending a nonce, some OCSP-Responders will answer with one. To allow an responder to use nonce for replay attack protection, it must include the nonce into ALL his responses - otherwise this particular response could be used in a replay. On a sidenote: the inclusion of a nonce would surely benefit the security - perhaps you can make it a configuration setting?

-- 
Florian Oelmaier
SyTrust

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ryan M. Hurst
Sent: Sunday, September 14, 2003 8:55 PM
To: Peter Gutmann; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Ryan

From: Peter Gutmann

Peter.

---

From: "Florian Oelmaier" <[email-masked]>
Date: Mon, 15 Sep 2003 00:13:47 +0200

Hello Ryan,
 
please note: although you are not sending a nonce, some OCSP-Responders
will answer with one. To allow an responder to use nonce for replay
attack protection, it must include the nonce into ALL his responses -
otherwise this particular response could be used in a replay. On a
sidenote: the inclusion of a nonce would surely benefit the security -
perhaps you can make it a configuration setting?
 
-- 
Florian Oelmaier
SyTrust
 
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Ryan M. Hurst
Sent: Sunday, September 14, 2003 8:55 PM
To: Peter Gutmann; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

Peter - I really don't think what we are doing is breaking OCSP's
security, after all nonce is a optional value in 2560 and the standard
already specifically supports response pre-production:

        OCSP responders MAY pre-produce signed responses specifying the
        status of certificates at a specified time. The time at which
the
        status was known to be correct SHALL be reflected in the
thisUpdate
        field of the response. The time at or before which newer
information
        will be available is reflected in the nextUpdate field, while
the
        time at which the response was produced will appear in the
producedAt
        field of the response.

And the only way to support this concept within OCSP would be to have
the described behavior in regards to nonce handling.
 
As for why OCSP was chosen over RTCS or a propietary solution, the goal
is to work with exiting public infrastrucutres and other third-party
solutions; given this OCSP was the obvious solution.
 
Ryan

  _____  

From: Peter Gutmann
Sent: Sun 9/14/2003 5:26 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

>handle very high peak volumes. 

Hmm, biting back my immediate response (that breaking OCSP's security
doesn't

seem like a good way to try and get usable performance out of it), why
not use

a protocol like RTCS, which was designed from the outset to allow for
high-

performance, highly scalable implementations?  It's not called real-time
cert

status for nothing (there's one organisation using it for exactly that,
they

do a real-time verification of cert validity using live validity data
before

Peter.

---

From: "Florian Oelmaier" <[email-masked]>
Date: Mon, 15 Sep 2003 01:20:09 +0200

Ryan M.Hurst wrote:
"On a side note, I don't think your buying yourself any security if you
server is generating a nonce if the request didn't contain one. After
all the idea of the nonce is to cryptographically bind a unique request
to a unique response and since the client doesn't have anything to
compare the nonce to I think you hurt your servers performance without
adding any  value."

Let us assume a responder produces responses with nonce only when the
request contains one. Thus it is easy for an attacker to obtain a valid
response of the responder without nonce (he only needs to send a request
without one). The attacker now replays this response to another client
using a nonce in his request. 

What does this other client see?
He sends a request with a nonce. The responder does not answer with a
nonce. According to the RfC, nonces are optional. Maybe the responder is
not capable of producing nonces. So it depends on the client - I saw
clients out there accepting the response, I also saw clients not
accepting it. 

Conclusion:
If the responder wants to protect itself against replay attacks, it
should include a nonce into every response it ever constructs. This way,
an attacker can never replay one of its responses to a client using
nonce (because the nonces would most probably mismatch).

About performance:
If the server does not preproduce responses, the nonce generation (16
random bytes) does not have any performance hit. I agree with you, when
preproducing responses, including a nonce does not make sense. From my
point of view, one could go without nonce in closed environments where
time synchronization is not an issue (meaning time is secure and
correct).

-- 
Florian Oelmaier
SyTrust

---

From: "Ambarish Malpani" <[email-masked]>
Date: Sun, 14 Sep 2003 16:57:45 -0700

Nachricht
Hi Florian,
    Including a nonce in the response where there isn't one in the request
doesn't buy you any additional security (unless the nonce has some different
semantics in your environment and isn't just a nonce).

Regards,
Ambarish
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On
Behalf Of Florian Oelmaier
  Sent: Sunday, September 14, 2003 3:14 PM
  To: 'Ryan M. Hurst'; 'Peter Gutmann'; [email-masked]; [email-masked]
  Subject: RE: [OCSP] are several requests for different CAs at once valid ?

  Hello Ryan,

  please note: although you are not sending a nonce, some OCSP-Responders
will answer with one. To allow an responder to use nonce for replay attack
protection, it must include the nonce into ALL his responses - otherwise
this particular response could be used in a replay. On a sidenote: the
inclusion of a nonce would surely benefit the security - perhaps you can
make it a configuration setting?

  --
  Florian Oelmaier
  SyTrust

  -----Original Message-----

    Ryan

----------------------------------------------------------------------------

    From: Peter Gutmann

seem like a good way to try and get usable performance out of it), why not
use

Peter.

---

From: "Florian Oelmaier" <[email-masked]>
Date: Mon, 15 Sep 2003 03:06:09 +0200

Hello Ambarish,
 
that depends on the client handling the nonce (see my message to Ryan).
I know you proposed some changes to the RfC to solve these problems back
in January 2002
(http://www.imc.org/ietf-pkix/mail-archive/msg02983.html) - yet I cant
find your changes in the RfC at http://www.ietf.org/rfc/rfc2560.txt. So
currently the published RfC does not instruct a client what to do when
the requests contained a nonce but the response didnt. For me that means
we can expect all kinds of behaviour out there.
 
Best regards,
Florian

-----Original Message-----
From: Ambarish Malpani [mailto:[email-masked]] 
Sent: Monday, September 15, 2003 1:58 AM
To: Florian Oelmaier; 'Ryan M. Hurst'; 'Peter Gutmann';
[email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

Hi Florian,
    Including a nonce in the response where there isn't one in the
request
doesn't buy you any additional security (unless the nonce has some
different
semantics in your environment and isn't just a nonce).
 
Regards,
Ambarish

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Florian Oelmaier
Sent: Sunday, September 14, 2003 3:14 PM
To: 'Ryan M. Hurst'; 'Peter Gutmann'; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

Hello Ryan,

-- 
Florian Oelmaier
SyTrust
 
-----Original Message-----

 
 
Ryan

  _____  

From: Peter Gutmann

Peter.

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Sun, 14 Sep 2003 21:33:40 -0700

Florian - I think there are two scenarios nonce's provide value in OCSP:

1. The server has a chance at knowing the request is unique.
2. The client can know the response he has been given was generated specifically for him.

#1 has the potential of adding some level of security on the server side (asuming several implementation details arround tracking the nonces) but since getting at the nonce still requires a decode, and likley a signature verify so the benefit is likley to be limited policy control and audit only.

#2 on the other hand is what I think the intention of the nonce in OCSP was intended for, specifically this is a way that a client can ensure he has a response that was generated just for him. This is particularly important in high value transation systems based on OCSP for work flow, these same systems also tend to require signed requests for the same fundematal reasons.

The scenario you outline bellow sounds like you are trying to protect the client from replay attacks by including the nonce, this however does not make sense since the client would just see a nonsensical 16byte value it would have nothing to compare to to ensure it is unique; the best it could do would be to see if it was one it had seen before but that would likley be accomplished through other means such as a hash of the response for quick indexing without the cost of a decode. 

I beleive the protection from this threat is to have the client require unique, dynamically generated responses.

Ryan

From: Florian Oelmaier
Sent: Sun 9/14/2003 4:20 PM
To: 'Ryan M. Hurst'
Cc: 'Peter Gutmann'; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Ryan M.Hurst wrote:

Conclusion:

About performance:

-- 
Florian Oelmaier
SyTrust

---

From: "Ambarish Malpani" <[email-masked]>
Date: Mon, 15 Sep 2003 07:25:01 -0700

Nachricht
Hi Florian,
    I believe the change with regards to nonces that isn't reflected in
current
version is that we didn't require nonces to be DER encoded (as an OCTET
STRING).

Is this the change you are talking about? If so, I don't think that has any
impact
on the issue of a responder sending a nonce if the requestor doesn't include
one.

Regards,
Ambarish
  -----Original Message-----
  From: Florian Oelmaier [mailto:[email-masked]]
  Sent: Sunday, September 14, 2003 6:06 PM
  To: 'Ambarish Malpani'; 'Ryan M. Hurst'; 'Peter Gutmann';

  Hello Ambarish,

  that depends on the client handling the nonce (see my message to Ryan). I
know you proposed some changes to the RfC to solve these problems back in
January 2002 (http://www.imc.org/ietf-pkix/mail-archive/msg02983.html) - yet
I cant find your changes in the RfC at http://www.ietf.org/rfc/rfc2560.txt.
So currently the published RfC does not instruct a client what to do when
the requests contained a nonce but the response didnt. For me that means we
can expect all kinds of behaviour out there.

  Best regards,
  Florian
    -----Original Message-----
    From: Ambarish Malpani [mailto:[email-masked]]
    Sent: Monday, September 15, 2003 1:58 AM
    To: Florian Oelmaier; 'Ryan M. Hurst'; 'Peter Gutmann';

    Hi Florian,

    Regards,
    Ambarish
      -----Original Message-----
      Subject: RE: [OCSP] are several requests for different CAs at once
valid ?

      Hello Ryan,

      please note: although you are not sending a nonce, some
OCSP-Responders will answer with one. To allow an responder to use nonce for
replay attack protection, it must include the nonce into ALL his responses -
otherwise this particular response could be used in a replay. On a sidenote:
the inclusion of a nonce would surely benefit the security - perhaps you can
make it a configuration setting?

      --
      Florian Oelmaier
      SyTrust

      -----Original Message-----
      From: [email-masked]
[mailto:[email-masked]] On Behalf Of Ryan M. Hurst
      Sent: Sunday, September 14, 2003 8:55 PM
      To: Peter Gutmann; [email-masked]; [email-masked]
      Subject: RE: [OCSP] are several requests for different CAs at once
valid ?

                OCSP responders MAY pre-produce signed responses specifying
the
                status of certificates at a specified time. The time at
which the
                status was known to be correct SHALL be reflected in the
thisUpdate
                field of the response. The time at or before which newer
information
                will be available is reflected in the nextUpdate field,
while the
                time at which the response was produced will appear in the
producedAt
                field of the response.

        And the only way to support this concept within OCSP would be to
have the described behavior in regards to nonce handling.

        As for why OCSP was chosen over RTCS or a propietary solution, the
goal is to work with exiting public infrastrucutres and other third-party
solutions; given this OCSP was the obvious solution.

        Ryan

------------------------------------------------------------------------

        From: Peter Gutmann
        Sent: Sun 9/14/2003 5:26 AM
        To: [email-masked]; [email-masked]; [email-masked]
        Subject: RE: [OCSP] are several requests for different CAs at once
valid ?

Peter.