Subject: [jose] OCSP/CRL info in JOSE

From: Anders Rundgren <[email-masked]>
Date: Thu, 26 Dec 2013 14:29:12 +0100

Pardon me all,
but I couldn't find any information about OCSP stapling or CRL bags in the JOSE docs.
I guess I'm just not reading properly?

Cheers
Anders

---

From: Richard Barnes <[email-masked]>
Date: Thu, 26 Dec 2013 11:20:05 -0500

No, you're not reading improperly, they don't exist.

It seems like you could define a "crl" or "ocsp" attribute to carry them,
though.  Should be a short Internet-draft.

--Richard

On Thu, Dec 26, 2013 at 8:29 AM, Anders Rundgren <
[email-masked]> wrote:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 27 Dec 2013 18:23:45 +0100

On 2013-12-26 17:20, Richard Barnes wrote:
> It seems like you could define a "crl" or "ocsp" attribute to carry them, though.  Should be a short Internet-draft.

Thanx Richard!

https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox

Apart from the privacy issue which mainly relates to users, revocation information
stapling should also reduce the need for keeping an additional HTTP port open in
sever-to-server scenarios like for e-invoicing and e-payments.

If I have the time I may add it to JCS which is my current priority item.

A preliminary spec (that should also fit JWS) is that optional OCSP or CRL properties
must be supplied as arrays of blobs (ASN.1 DER structures) with length <= number of certificates in the path ("x5c" in JWS)
and where each revocation blob is supposed to be on the array-wise matching position with respect to the certificate path array.

Maybe a bit "hackish" but quite simple to implement.  Finesse? Who cares :-)

Anders

> 
> --Richard
> 
> 
> On Thu, Dec 26, 2013 at 8:29 AM, Anders Rundgren <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     Pardon me all,
>     [email-masked] <mailto:[email-masked]>

---

From: Anders Rundgren <[email-masked]>
Date: Sun, 29 Dec 2013 11:55:53 +0100

> It seems like you could define a "crl" or "ocsp" attribute to carry them, though.  Should be a short Internet-draft.

I cheated by throwing in the kitchen sink instead:
https://openkeystore.googlecode.com/svn/resources/trunk/docs/jcs.html#Signature.Extensions

Cheers,
Anders