Subject: RE: DISCUSS: MUST reject in OCSPv1

From: "Deacon, Alex" <[email-masked]>
Date: Mon, 15 Dec 2003 09:20:48 -0800

Mike,

> -----Original Message-----
> From: Michael Myers [mailto:[email-masked]] 
[snip]
> 
> Tom,
> 
> We may be saying the same thing:
> 
> if( req->sent_nonce != rsp->rcvd_nonce )
>    fail( BADNONCE )
> else
>    proceed( rsp );
> 
> The more interesting question along these lines is the one 
> regarding Florian's server-unilateral nonces.  I.e. a client 
> receives a nonce extension in the response even though the 
> client didn't provide a nonce extension in its request.  
> While I'm not yet convinced of this practice's security 
> value, I see no reason to preclude it in our forthcoming 
> clarification regarding nonces.

As I mentioned earlier, it will be important to clarify this case as clients
using piggybacked OCSPResponses (such as those implementing the TLS
extension) may receive a response that contains a nonce (the one the server
generated) eventhough they did not send one.

Alex

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 15 Dec 2003 10:54:10 -0700

> From: Deacon, Alex [mailto:[email-masked]]
> Sent: Monday, December 15, 2003 10:21 AM
>
> As I mentioned earlier, it will be important to
> clarify this case as clients using piggybacked
> OCSPResponses (such as those implementing the TLS
> extension) may receive a response that contains a
> nonce (the one the server generated) event though
> they did not send one.

Alex,

To be clear, are you referring to server-unilateral nonces?

Or to the fact that a TLS server may have in cache a nonced
response (retained as a consequence of a prior nonced request)
that it sends back in the TLS handshake even though the TLS
client did not supply a nonce in its embedded OCSP request?

Mike