Subject: [pkix] Explanation of the OCSP sign request (RFC 2560)

From: Robert Hernady <[email-masked]>
Date: Wed, 22 Feb 2012 07:30:31 +0000

Hi,

I'm looking for the better understanding for the RFC 2560  Online Certificate Status Protocol - OCSP.

The section 4.1 defines the ASN.1 structure for the OCSP request. Follows the shortened structure.

OCSPRequest
   TBSRequest
   OPTIONAL Signature,

where the signature is marked as OPTIONAL. That one leads to the conclusion that signing of the OCSP request is not required and the implementer of the OCSP client MAY digitally sign that request.

But the section 2.3  Exception Cases defines error types and one of them is "-sigRequired"

   The response "sigRequired" is returned in cases where the server
   requires the client sign the request in order to construct a
   response.

Does it mean that in that case the signature of the request becomes mandatory? Does it mean that OCSP clients that have not implemented OCSP request signing after receiving error "-sigRequired" are breaking this RFC?

Thanks in advance

Robert Hernady

---

From: "Miller, Timothy J." <[email-masked]>
Date: Wed, 22 Feb 2012 13:53:01 +0000

The signature is optional per the protocol spec, but a specific server
implementation is allowed to make it mandatory.  That's pretty standard
behavior--you (the implementor or deployer) are free to required options
that make sense in your environment.

Personally I'm not sure why anyone would make sigs mandatory on OCSP
requests, but I'm sure someone can come up with a reason.  :)

-- T

On 2/22/12 1:30 AM, "Robert Hernady" <[email-masked]> wrote:

>Hi,
> 
>I¹m looking for the better understanding for the RFC
>2560  Online Certificate Status Protocol  OCSP.
> 
>where the signature is marked as OPTIONAL. That one leads to the
>conclusion that signing of the OCSP request is not required and the
>implementer of the OCSP client MAY digitally sign that request.
>
> 
>But the section 2.3  Exception Cases defines error types and one of them
>is ³‹sigRequired²
> 
>Does it mean that in that case the signature of the request becomes
>mandatory? Does it mean that OCSP clients that have not implemented OCSP
>request signing after receiving error ³‹sigRequired² are breaking this
>RFC?
>
> 
>Thanks in advance
> 
>Robert Hernady
> 
>
>
>
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: Simon Tardell <[email-masked]>
Date: Wed, 22 Feb 2012 17:55:27 +0100

Sent from my iPhone

> requests, but I'm sure someone can come up with a reason.  :)

Billing.

One not uncommon model in public PKIs is to enroll people for free but charge the relying party per use.

/Simon

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 23 Feb 2012 14:01:54 +1300

"Miller, Timothy J." <[email-masked]> writes:

>Personally I'm not sure why anyone would make sigs mandatory on OCSP requests,
>but I'm sure someone can come up with a reason. :)

For billing purposes, when the CA charges for revocation checks.

(It's actually used for that. Then the clients disable rev.checks in order to 
save money, which also actually happens).

Peter.