RE: OCSP Algorithm Agility

[Stefan Santesson <[e-mail]>]

Phil,

Good that you bring this subject on the table again. We have agreed for quite some time that something needs to be done.
Nothing has happened in the absence of any volunteers to actually do the work.

I think it would be great if you want to formalize your proposal in an ID. In the end we need to develop any solution we choose as a PKIX document, if our ADs give us their blessing.
It would be great to know if we now have enough people interested to actually contribute to such an effort.


Stefan Santesson
Senior Program Manager
Windows Security, Standards

From: [e-mail] [mailto:[e-mail]] On Behalf Of Hallam-Baker, Phillip
Sent: den 18 september 2007 11:53
To: pkix
Subject: OCSP Algorithm Agility

Looking at places where we currently use SHA-1 it appears that there will soon be a need to support SHA-256 in OCSP.

In particular we need a mechanism to allow the requestor to state which algorithms they can accept from the responder. I did a sketch of a scheme (see below).

The question is how best to get this processed. Algorithm agility is one of the issues that is blocking advance of OCSP on the standards track so if this was the only issue that was blocking advancement it would perhaps make sense to rev the OCSP RFC.

Alternatively it might be considered preferable to address algorithms agility 'across the board'. Although the only other protocol that is analagous is SCVP. I don't think the mechanism specified there translates to OCSP.

So I was thinking that a good place to start was probably to submit some variation of the following as a personal ID:
The extension would need to be something like

id-pkix-ocsp-algorithmselectors   OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 }

AlgorithmSelectors ::= SEQUENCE OF AlgorithmSelectorEntry

AlgorithmSelectorEntry ::= SEQUENCE {
    SignatureAlgorithm   [0] OBJECT IDENTIFIER OPTIONAL,
    DigestAlgorithm   [1] OBJECT IDENTIFIER OPTIONAL,
    }

The responder SHOULD sign the reponse with a signature algorithm and digest algorithm pair that match one ot the following criteria:

1) The Signature and Digest algorithm both match an algorithm selector entry exactly.

or

2) The Signature Algorithm used matches an algorithm selector entry where only the Signature Algorithm OID is specified and the digest algorithm matches an algorithm selector entry where only the Digest Algorithm OID is specified.


So for example a requestor can stipulate that they will accept any combination of RSA-1024, RSA-2048, SHA-1 and SHA-256 or DSA2 with SHA-256 as follows:

{SignatureAlgorithm   RSA-1024}
{SignatureAlgorithm   RSA-2048}
{DigestAlgorithm      SHA-1 }
{DigestAlgorithm      SHA-256  }
{SignatureAlgorithm   DSA2, DigestAlgorithm      SHA-1 }

The rationale here is that in most cases the signature and digest algorithms are 'mix and match'. But sometimes they are not, in particular if specific signature hardware is to be used.

I note that SCVP does something rather different but I don't see how the scheme specified there would fit OCSP.