Subject: RE: [OCSP] are several requests for different CAs at once valid ?

From: "Florian Oelmaier" <[email-masked]>
Date: 15 Sep 2003 14:33:29 -0000

Hello Ambarish,

that was your change note I am referring:

- Section 4.4.1 - Clarified that a nonce in the request MUST be included in the response for the response to be trusted.

Additionally you added a requirement 8 to 3.2:
   8. If the request contained a nonce, the response must contain the
      same nonce (see section 4.4.1).

These changes would have instructed the clients what to do with nonceless responses where the request contains one. Right now the standard does not instruct the clients what to do in this case.

-- 
Florian Oelmaier
SyTrust

On Mon, 15 Sep 2003 07:25:01 -0700, "Ambarish Malpani" <[email-masked]> wrote :

> This is a multi-part message in MIME format.
> 
> 
> Nachricht
> Hi Florian,
>     I believe the change with regards to nonces that isn't reflected in
> current
> version is that we didn't require nonces to be DER encoded (as an OCTET
> STRING).
> 
> Is this the change you are talking about? If so, I don't think that has any
> impact
> on the issue of a responder sending a nonce if the requestor doesn't include
> one.
> 
> Regards,
> Ambarish
>   -----Original Message-----
>   From: Florian Oelmaier [mailto:[email-masked]]
>   Sent: Sunday, September 14, 2003 6:06 PM
>   To: 'Ambarish Malpani'; 'Ryan M. Hurst'; 'Peter Gutmann';
> [email-masked]; [email-masked]
>   Subject: RE: [OCSP] are several requests for different CAs at once valid ?
> 
> 
>   Hello Ambarish,
> 
>   that depends on the client handling the nonce (see my message to Ryan). I
> know you proposed some changes to the RfC to solve these problems back in
> January 2002 (http://www.imc.org/ietf-pkix/mail-archive/msg02983.html) - yet
> I cant find your changes in the RfC at http://www.ietf.org/rfc/rfc2560.txt.
> So currently the published RfC does not instruct a client what to do when
> the requests contained a nonce but the response didnt. For me that means we
> can expect all kinds of behaviour out there.
> 
>   Best regards,
>   Florian
>     -----Original Message-----
>     From: Ambarish Malpani [mailto:[email-masked]]
>     Sent: Monday, September 15, 2003 1:58 AM
>     To: Florian Oelmaier; 'Ryan M. Hurst'; 'Peter Gutmann';
> [email-masked]; [email-masked]
>     Subject: RE: [OCSP] are several requests for different CAs at once valid
> ?
> 
> 
> 
>     Hi Florian,
>         Including a nonce in the response where there isn't one in the
> request
>     doesn't buy you any additional security (unless the nonce has some
> different
>     semantics in your environment and isn't just a nonce).
> 
>     Regards,
>     Ambarish
>       -----Original Message-----
>       From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Florian Oelmaier
>       Sent: Sunday, September 14, 2003 3:14 PM
>       To: 'Ryan M. Hurst'; 'Peter Gutmann'; [email-masked]; [email-masked]
>       Subject: RE: [OCSP] are several requests for different CAs at once
> valid ?
> 
> 
>       Hello Ryan,
> 
>       please note: although you are not sending a nonce, some
> OCSP-Responders will answer with one. To allow an responder to use nonce for
> replay attack protection, it must include the nonce into ALL his responses -
> otherwise this particular response could be used in a replay. On a sidenote:
> the inclusion of a nonce would surely benefit the security - perhaps you can
> make it a configuration setting?
> 
>       --
>       Florian Oelmaier
>       SyTrust
> 
>       -----Original Message-----
>       From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Ryan M. Hurst
>       Sent: Sunday, September 14, 2003 8:55 PM
>       To: Peter Gutmann; [email-masked]; [email-masked]
>       Subject: RE: [OCSP] are several requests for different CAs at once
> valid ?
> 
> 
>         Peter - I really don't think what we are doing is breaking OCSP's
> security, after all nonce is a optional value in 2560 and the standard
> already specifically supports response pre-production:
> 
>              2.5  Response Pre-production
> 
>                 OCSP responders MAY pre-produce signed responses specifying
> the
>                 status of certificates at a specified time. The time at
> which the
>                 status was known to be correct SHALL be reflected in the
> thisUpdate
>                 field of the response. The time at or before which newer
> information
>                 will be available is reflected in the nextUpdate field,
> while the
>                 time at which the response was produced will appear in the
> producedAt
>                 field of the response.
> 
>         And the only way to support this concept within OCSP would be to
> have the described behavior in regards to nonce handling.
> 
>         As for why OCSP was chosen over RTCS or a propietary solution, the
> goal is to work with exiting public infrastrucutres and other third-party
> solutions; given this OCSP was the obvious solution.
> 
>         Ryan
> 
> 
> ------------------------------------------------------------------------
> 
>         From: Peter Gutmann
>         Sent: Sun 9/14/2003 5:26 AM
>         To: [email-masked]; [email-masked]; [email-masked]
>         Subject: RE: [OCSP] are several requests for different CAs at once
> valid ?
> 
> 
> "Ryan M. Hurst" <[email-masked]> writes:
> 
> >Traditionally OCSP responders generate and sign responses on-demand
> >(dynamically), this requires the responders to scale their infrastructure
> to
> >handle very high peak volumes.
> 
> Hmm, biting back my immediate response (that breaking OCSP's security
> doesn't
> seem like a good way to try and get usable performance out of it), why not
> use
> a protocol like RTCS, which was designed from the outset to allow for high-
> performance, highly scalable implementations?  It's not called real-time
> cert
> status for nothing (there's one organisation using it for exactly that, they
> do a real-time verification of cert validity using live validity data before
> each and every use of the cert).
> 
> Peter.
> 
>

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Mon, 15 Sep 2003 08:14:47 -0700

Since were talking changes ;) I have provided some suggested text for one of the comments bellow. Also if changes are going to be made further clarifications should be made:

1. HTTP GET vs. POST: Additional text is needed to indicate that GET is most appropriate for environments where response pre-production and network infrastructure caching is to be used.
2. HTTP headers: Additional text is needed to indicate that the HTTP cache related headers should be used so that network infrastructure can deal with these responses appropriately; e.g. servers that do not include a nonce and do not wish their responses to be cached should add the no-cache header, and that implementations that accept that their responses be cached should set the cache expiration to be in accordance with the response expiration.
3. Responder Identification: Additional text is needed to indicate why byKey is the better choice, specifically when making responses for certificates issued by more than one issuing authority.
4. Nonce: Additional text is needed on when to include a nonce, in addition to the bellow text its a good idea to say something along the lines of "in environments that support pre-produced responses clients can include a nonce to indicate that they want a freshly generated response, servers should assume that if the client includes a nonce that a new request should be generated.

Ryan  

From: Florian Oelmaier
Sent: Mon 9/15/2003 7:33 AM
To: Ambarish Malpani; Florian Oelmaier; 'Ryan M. Hurst'; 'Peter Gutmann'; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Hello Ambarish,

[rmh] How about "Clients that require protection from re-play attacks MUST include a response in their request and MUST require the resulting response contains the same nonce."

-- 
Florian Oelmaier
SyTrust