Subject: RE: Clarification request on RFC 2560

From: Ryan Hurst <[email-masked]>
Date: Fri, 14 Sep 2001 09:47:22 -0700

Steve --

	Well there goes one of my examples then :), I vaguely remember a
post to the OpenSSL dev list that implied that was what was implemented in
its implementation of OCSP.

Lets change the question, is there consensus that this is the correct usage
of the certs[] attribute? 

I personally believe so; I do not see how one could deal with multiple ca
responses without this methodology. Additionally I do not see any downsides
to this method.

Ryan

-----Original Message-----
From: Dr S N Henson [mailto:[email-masked]] 
Sent: Friday, September 14, 2001 4:01 AM
To: Pkix (E-mail)
Subject: Re: Clarification request on RFC 2560

Ryan Hurst wrote:
> 
> 
> 
> <rmh>You are correct we are looking to prove #3 in this case, the response
> would have contained the each of the responder certificates associated
with
> the signature in the certs[] attribute (eg all three delegated responder
> certificates). The client would then look at each of the CertIDs in the
> response and then make sure that it had it can verify #3 against the
certs[]
> structure (of coarse after confirming that they are trusted).</rmh>
> 

I wonder how many OCSP clients actually behave like that? OpenSSL,
currently at least, doesn't.

An OCSP client might assume that only a single certificate corresponds
to the responder ID and for example just look for the first certificate
in the certs attribute which matches the reponder ID and verify that.
This would reject the response in the above scenario.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.

---

From: Dr S N Henson <[email-masked]>
Date: Fri, 14 Sep 2001 19:20:44 +0100

> of the certs[] attribute?

I would say that RFC2560 is unclear on this point. Some might take the
wording to suggest otherwise. For example twice in section 4.2.2.2 it
uses the term:

"the certificate used to validate the signature on the response".

The use of "the" might be taking to mean that there is only one such
certificate.

> responses without this methodology. Additionally I do not see any downsides

Certainly without this methodology it can't be handled via a delegated
responder certificate. That would just leave the messy alternative of
local configuration.

Steve.