Re: [lamps] [EXTERNAL]Re: RFC6960: Issue with the OCSP Nonce extension

[Mohit Sahni <[e-mail]>]

Hi Rich,
Currently RFC 6960 defines the OCSP nonce in section 4.4.1 and it does not
mention anything about minimum and a maximum length on nonce. I proposed a
range for length as1-32 octets keeping in mind the backward compatibility.
There may be some older clients and responders which may be
sending/processing different lengths of nonce. Based on the feedback by
Thomas, I proposed an upper bound of 32 as its already working in a popular
PKI implementation and they have not seen any issues with that. Please see
this link for more background on this:
https://mailarchive.ietf.org/arch/msg/spasm/2aKuvO6YomMsxbuCv4lHq05Uaac/

I will add text to strongly suggest that a nonce length should be between
16-32 octets and make sure implementations know the risk of using smaller
size nonce.

Thanks
Mohit

On Mon, Mar 2, 2020 at 1:33 PM Salz, Rich <[e-mail]> wrote:

> Which is more important than cryptographically strong.  A one-byte value
> can all too easily wrap.  A 32bit sequence number probably suffices.
>
> On 3/2/20, 4:32 PM, "Tomas Gustavsson" <[e-mail]>
> wrote:
>
>
>     Agreed. And never re-use a nonce, should be new, random, for every
> request.
>
>     Cheers,
>     Tomas
>
>     On 2020-03-02 13:26, Mohit Sahni wrote:
>     > I agree to you regarding the nonce, collision and I will update the
>     > draft with statement that clients SHOULD use “cryptographically
> strong
>     > randomness” and it's more secure to have nonce to be between 16-32
>     > octets long.
>
>
>
>