Subject: RE: [OCSP] are several requests for different CAs at once valid ?

From: "Ryan M. Hurst" <[email-masked]>
Date: Mon, 15 Sep 2003 08:54:33 -0700

Florian - I will see about getting a option to disable support for pre-produced responses, but I beleive the correct interpretation of the nonce on the server side is "I want a fresh response", given this including a nonce when we don't care if we get one back removes a way for us to communicate with servers out there so I don't think we will do that.

Ryan

From: Florian Oelmaier
Sent: Mon 9/15/2003 8:47 AM
To: Ryan M. Hurst; Peter Gutmann; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

> Florian - We will be fine with your server generated nonce, but I still 
> hold to my original statement that this does not protect your server 
> from anything, and as for your client expecting a nonce in a reply,  
> it should simply make sure the nonce in the request matches the nonce in 
> the received reply as thats the only way to truly protect against a 
> replay attack on the client side.

An alternate proposal for you client:
1) your client always generates a nonce in its request.
2) your client accepts responses not containing a nonce at all as valid, if the response contains a nonce, it has to be the correct one.

What will happen?

When sending a request to a responder that preproduces responses, your client will receive a response without nonce. Your client will accept it. Security is not worse than your original proposal. 

When sending a request to a responder that ALWAYS! uses nonces in his responses, you WILL get a nonce back (even when it was replay attack, as an attacker cannot obtain a response without nonce). Your client will check it and accept it when it matches. With such a responder the nonces protection works as designed.

When sending a request to a responder that uses nonces only when the request contained one, you may get a correct nonce back or (in case of a replay attack) a response without nonce. Either way you will accept it (as your client does not know if that responder sends nonces or not). Security is not worse than your original proposal.

With this proposal your client lets the responder decide wether it wants to make use of nonce-security or not. So it seems to be an improvement without any disadvantages.

-- 
Florian Oelmaier
SyTrust

---

From: "Florian Oelmaier" <[email-masked]>
Date: 15 Sep 2003 15:47:52 -0000

What will happen?

-- 
Florian Oelmaier
SyTrust

---

From: "Ambarish Malpani" <[email-masked]>
Date: Mon, 15 Sep 2003 10:40:18 -0700

Hi Ryan,
    I agree with your statement below. If a client has a nonce in the
request, it MUST NOT accept
a response without a nonce. If you are willing to accept a response without
a nonce, don't include
one in the request.
 
The main problem of not having a nonce in the request is you might be open
to a replay attack and
you should have a decently accurate clock.
 
If you know how accurate your clock is, you can bound the time during which
you are open to
a reply attack by accepting pre-produced responses that were produced
acceptably recently
(NOTE: I am not addressing the following 2 questions:
    -how you know how accurate your clock is
    - how recently you should require the response to have been produced
(depends on your policy))
If the pre-produced response is too old for your purposes, you can always
include a nonce to
force a new response.

Regards,
Ambarish

-----Original Message-----
From: Ryan M. Hurst [mailto:[email-masked]] 
Sent: Monday, September 15, 2003 8:55 AM
To: Florian Oelmaier; Peter Gutmann; [email-masked];
[email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

Florian - I will see about getting a option to disable support for
pre-produced responses, but I beleive the correct interpretation of the
nonce on the server side is "I want a fresh response", given this including
a nonce when we don't care if we get one back removes a way for us to
communicate with servers out there so I don't think we will do that.
 
Ryan

  _____  

From: Florian Oelmaier
Sent: Mon 9/15/2003 8:47 AM
To: Ryan M. Hurst; Peter Gutmann; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid ?

2) your client accepts responses not containing a nonce at all as valid, if
the response contains a nonce, it has to be the correct one.

What will happen?

When sending a request to a responder that preproduces responses, your
client will receive a response without nonce. Your client will accept it.
Security is not worse than your original proposal. 

When sending a request to a responder that ALWAYS! uses nonces in his
responses, you WILL get a nonce back (even when it was replay attack, as an
attacker cannot obtain a response without nonce). Your client will check it
and accept it when it matches. With such a responder the nonces protection
works as designed.

When sending a request to a responder that uses nonces only when the request
contained one, you may get a correct nonce back or (in case of a replay
attack) a response without nonce. Either way you will accept it (as your
client does not know if that responder sends nonces or not). Security is not
worse than your original proposal.

With this proposal your client lets the responder decide wether it wants to
make use of nonce-security or not. So it seems to be an improvement without
any disadvantages.

-- 

Florian Oelmaier

SyTrust

---

From: "Florian Oelmaier" <[email-masked]>
Date: Tue, 16 Sep 2003 01:31:34 +0200

I agree with Ryan statement, too - but I see a difference in the way
Ambarish rephrases it:
 
A nonce in the request indicates:
Ryan: "I want a fresh response"
Ambarish: I am not willing to accept a response without a nonce
 
I think the first way adds a lot of flexibility to the protocol: The
responder detects that the client would like to have a fresh response
(who would not like that!) and can then decide to produce a new one or
to present a pre-produced response (without nonce). In the case of  the
pre-produced response the client can decide wether to accept it or not.
 
I dont see the reason to limit the functionality of the protocol by
going down the second road - without any benefit attached to it.
 
If we want the OCSP responder to know beforehand, if the client will
accept a pre-produced response or not, add a CRITICAL flag to the
extension. This way the client can indicate in the request if it is
willing to accept a response without nonce.
 
For me the inclusion of a nonce into a request indicates: "I want a
fresh response, I will check the nonce if you give me one back, if not I
will decide on my own if I will accept the response or not".
 
-- 
Florian Oelmaier
SyTrust

-----Original Message-----
From: Ambarish Malpani [mailto:[email-masked]] 
Sent: Monday, September 15, 2003 7:40 PM
To: 'Ryan M. Hurst'; 'Florian Oelmaier'; 'Peter Gutmann';
[email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

Hi Ryan,
    I agree with your statement below. If a client has a nonce in the
request, it MUST NOT accept
a response without a nonce. If you are willing to accept a response
without a nonce, don't include
one in the request.
 
The main problem of not having a nonce in the request is you might be
open to a replay attack and
you should have a decently accurate clock.
 
If you know how accurate your clock is, you can bound the time during
which you are open to
a reply attack by accepting pre-produced responses that were produced
acceptably recently
(NOTE: I am not addressing the following 2 questions:
    -how you know how accurate your clock is
    - how recently you should require the response to have been produced
(depends on your policy))
If the pre-produced response is too old for your purposes, you can
always include a nonce to
force a new response.

Regards,
Ambarish

-----Original Message-----
From: Ryan M. Hurst [mailto:[email-masked]] 
Sent: Monday, September 15, 2003 8:55 AM
To: Florian Oelmaier; Peter Gutmann; [email-masked];
[email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

Florian - I will see about getting a option to disable support for
pre-produced responses, but I beleive the correct interpretation of the
nonce on the server side is "I want a fresh response", given this
including a nonce when we don't care if we get one back removes a way
for us to communicate with servers out there so I don't think we will do
that.
 
Ryan

  _____  

From: Florian Oelmaier
Sent: Mon 9/15/2003 8:47 AM
To: Ryan M. Hurst; Peter Gutmann; [email-masked];
[email-masked]; [email-masked]; [email-masked]
Subject: RE: [OCSP] are several requests for different CAs at once valid
?

2) your client accepts responses not containing a nonce at all as valid,
if the response contains a nonce, it has to be the correct one.

What will happen?

When sending a request to a responder that preproduces responses, your
client will receive a response without nonce. Your client will accept
it. Security is not worse than your original proposal. 

When sending a request to a responder that ALWAYS! uses nonces in his
responses, you WILL get a nonce back (even when it was replay attack, as
an attacker cannot obtain a response without nonce). Your client will
check it and accept it when it matches. With such a responder the nonces
protection works as designed.

When sending a request to a responder that uses nonces only when the
request contained one, you may get a correct nonce back or (in case of a
replay attack) a response without nonce. Either way you will accept it
(as your client does not know if that responder sends nonces or not).
Security is not worse than your original proposal.

With this proposal your client lets the responder decide wether it wants
to make use of nonce-security or not. So it seems to be an improvement
without any disadvantages.

-- 

Florian Oelmaier

SyTrust