Subject: RE: DISCUSS: MUST reject in OCSPv1

From: "Florian Oelmaier" <[email-masked]>
Date: 4 Dec 2003 09:46:34 -0000

> I like the elegance of Russ and Florian's ideas for securely signalling 
> that a server doesn't support nonces by using a special value for the 
> nonce in replies.  This seems like the "right" place to put this message 
> to the client.

Just for the record: I think you are referring to our server-generated nonces when you talk about "Florian's idea". And while Russel is signalling "NonceUnsupported" with a special nonce-value, we are singalling "NonceSupported" with the inclusion of a nonce into every request (mirrored from the request or server-generated). Thus we are not subject to the attack you mention, as this does not need any additional code in any existing client.

Russ proposal is a change in the protocol. Thus we need to update all the clients and servers out there. Seeing that the proposed change is needed and recognizing it as a good solution, I would accept this. 

-- 
Florian Oelmaier
SyTrust

---

From: David Engberg <[email-masked]>
Date: Thu, 04 Dec 2003 08:10:13 -0500

Florian -

Sorry, my misunderstanding.  I think that your strategy is also good if 
both the client and server implement it, but it sounds like your clients 
would have the same backward-compatibility problem if talking to someone 
else's old servers.  I.e. an attacker could send a nonceless request to 
an old existing server and record the nonceless response, and then 
replay that to your client to make you think that that server is 
securely signalling that it doesn't support nonces.

Does that make sense?