Subject: RE: [OCSP] are several requests for different CAs at once valid ?

From: [email-masked] (Peter Gutmann)
Date: Tue, 16 Sep 2003 01:48:39 +1200

"Florian Oelmaier" <[email-masked]> writes:

>So currently the published RfC does not instruct a client what to do when the
>requests contained a nonce but the response didnt. For me that means we can
>expect all kinds of behaviour out there.

My code treats a nonceless response as pretty much worthless (it could be a
replay, there's no way to tell) and rejects it.  I've heard from a few other
vendors out there, and there's a mixture of implementations rejecting
nonceless messages as insecure, and "performance-tuned" implementations
deliberately sending them to make replays possible.

I do think that if you're going to use nonceless messages for performance
reasons you may as well optimise things a step further and just pop up a
dialog that says "Everything seems to be OK as far as I can tell", avoiding
the overhead of submitting a query at all.  If everything's OK then you get a
nice fast response, and if everything's not OK (there's an attacker spoofing
responses) you wouldn't know anyway, so why bother even pretending?  As a
side-benefit, you can advertise your product as a high-performance OCSP
responder...

Peter.

---

From: "Liaquat Khan" <[email-masked]>
Date: Mon, 15 Sep 2003 15:21:28 +0100

:-) I like it!

Our OCSP responder by default requires a nonce to be present in OCSP
requests.  If it is missing, it rejects the request.  This requirement
can be switched off by the administrator, in which case OCSP requests
without a nonce will also be processed. 

Our Windows-based OCSP client by default sends a nonce in all OCSP
requests and then compares this with nonce sent back the server.  If the
nonce comparison fails then the OCSP response is rejected.  However, in
our OCSP client, it is possible to change the default setting so that a
nonce is not included in OCSP requests.   

Regard,
LK

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Peter Gutmann
Sent: 15 September 2003 14:49
To: [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

>expect all kinds of behaviour out there.

My code treats a nonceless response as pretty much worthless (it could
be a
replay, there's no way to tell) and rejects it.  I've heard from a few
other
vendors out there, and there's a mixture of implementations rejecting
nonceless messages as insecure, and "performance-tuned" implementations
deliberately sending them to make replays possible.

I do think that if you're going to use nonceless messages for
performance
reasons you may as well optimise things a step further and just pop up a
dialog that says "Everything seems to be OK as far as I can tell",
avoiding
the overhead of submitting a query at all.  If everything's OK then you
get a
nice fast response, and if everything's not OK (there's an attacker
spoofing
responses) you wouldn't know anyway, so why bother even pretending?  As
a
side-benefit, you can advertise your product as a high-performance OCSP
responder...

Peter.

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Mon, 15 Sep 2003 07:52:15 -0700

Now your just being silly Peter, using pre-produced OCSP responses is no worse that using CRLs and it is a cocept explicitly supported by the RFC for the very reasons we implemented it that way. 

Florian - We will be fine with your server generated nonce, but I still hold to my original statement that this does not protect your server from anything, and as for your client expecting a nonce in a reply,  it should simply make sure the nonce in the request matches the nonce in the received reply as thats the only way to truly protect against a replay attack on the client side.

Ryanb

From: Peter Gutmann
Sent: Mon 9/15/2003 6:48 AM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Peter.