[lamps] RFC6960: Issue with the OCSP Nonce extension

[Mohit Sahni <[e-mail]>]

Hi All,
The section 4.1.1 of the RFC6960 describes the format and ID for the Nonce
extension in the OCSP request and response. According to the RFC the nonce
will have the identifier id-pkix-ocsp-nonce and the type of the Nonce is an
OCTATE STRING.  The problem I see is that the RFC does not mention whether
the nonce should be of fixed length or should have a maximum length. Due to
this reason the current implementations that follow this standard can
accept very large OCSP requests and are vulnerable to denial of service
attacks and various evasion tricks using the nonce field as a tunnel. Since
most of the OCSP requests don't use TLS as transport someone in the path
can also modify the HTTP request to inject large nonce thus making the
situation worse.

I would like to propose that the standard MUST define a maximum length for
Nonce or the Nonce MUST be of a defined fixed length. I lean towards
proposing the standard to have a maximum value of 256 bytes and minimum
value of 1 byte to make it backward compatible.

Do you guys think it makes sense and if I should propose a draft for making
Nonce length with a maximum of 256 and minimum of 1.

Here is the text from section 4.1.1 of RFC6960:

   The nonce cryptographically binds a request and a response to prevent
   replay attacks.  The nonce is included as one of the
   requestExtensions in requests, while in responses it would be
   included as one of the responseExtensions.  In both the request and
   the response, the nonce will be identified by the object identifier
   id-pkix-ocsp-nonce, while the extnValue is the value of the nonce.

     id-pkix-ocsp           OBJECT IDENTIFIER ::= { id-ad-ocsp }
     id-pkix-ocsp-nonce     OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }

     Nonce ::= OCTET STRING

-Mohit