Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

[[e-mail] (Martin Rex)]

Piyush Jain wrote:
>  
>> The "cert hash" in the OCSP response option protects against
>> hash-collisions
>> and fraudulently issued without record of certs that re-use the serial of
>> regular valid certs to appear innocent from not being detectable.
>> 
>> So that cert hash should probably use at least SHA-256.  Being a new
>> protocol feature, that ought to be easy (we skipped SHA-1 in DANE as well).
> 
> [Piyush]  I think you mean appears to protect. 
> I hope people really don't start believing that this extension
> protects them from a CA compromise scenario.


You're confusing things.  The reason why this protection currently
does not work is not that there is a problem with conveying back
the hash, but that the current scheme to identify an authorized OCSP
responder cert is fatally flawed.

Fixing the authorized OCSP responder issue is by defining a new
attribute that is hardwired into the CA cert in order to establish
an alternative trust path.


The other thing you seem to totally discount is that not every
breach of the CAs security amounts to a full and thorough compromise,
i.e. that the attacker can get hold of an carry away the CA private
signature key.


-Martin