Re: [pkix] [TLS] New version of the TLS feature draft

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2014-09-03 at 16:40 -0400, Phillip Hallam-Baker wrote:
> This draft is just a bit of wiring that allows TLS clients to make
> intelligent and efficient hardfail decisions when a TLS server
> supports OCSP stapling.
> 
> OCSP stapling has been supported for some time and when supported by a
> server allows a client to obtain OCSP status information direct from
> the server rather than going hunting for it from a distribution point.
> 
> What makes OCSP stapling rather less useful than it should be is that
> a TLS client does not know whether it should expect a TLS token or
> not. So the absence of an OCSP token could be because the server does
> not support stapling or could be because the CA has revoked the
> certificate with extreme prejudice because it is being used to commit
> fraud against people visiting the corresponding Web site.
> The TLS feature extension allows a certificate to state which TLS
> features a server using the cert MUST support. This closes the door on
> the downgrade attack.

I don't see how it does close the door. What should the client do if the
server administrator sets up an old version of a valid ocsp staple? This
case is not discussed in the security considerations at all.

regards,
Nikos