Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

[[e-mail] (Martin Rex)]

Piyush Jain wrote:
> 
> The people who are convinced that this is the way to go have not addressed
> the issues raised in this WG. The little extension does not hurt anyone but
> it does not provide any value in general except to a few implementations
> which are compromised. But it does take you down a slippery slope when you
> start promising that an OCSP responder can do much more than it is supposed
> to.
> 
> I don't think that it is unreasonable for a smart implementer to stop
> signature checking if his responder claims that it checks issuance. 


I completely fail to follow your argument here.

When you say "stop signature checking", do you mean checking the
CA signature on the certificate for which you perform the OCSP request?

In the exceptional case that
  - you exclusively use a securely preconfigured local OCSP responder,
  - this securely preconfigured local OCSP responder uses the optional
    cert hash extension in his responses and the hash returned with
    a good response matches the cert in question
  - you fully trust that securely preconfigured local OCSP responder
    to issue any cert it pleases like an omnipotent universal CA

then you may omit the signature check on the certificate in question.

In all other situations, you MUST verify the CA signature of the certificate
before using any OCSP AIA in that cert to query its status -- or you
misunderstand the X.509 security architecture and why it is vitally
important that (a) (1) is the very first step in the certificate
processing specified in PKIX/rfc5280:

   http://tools.ietf.org/html/rfc5280#section-6.1.3


-Martin