Re: [TLS] New version of Multiple OCSP mode of Certificate Status

[Martin Rex <[e-mail]>]

Yngve Nysaeter Pettersen wrote:
> 
> Opera has a 15-20 second timeout for such operations, as well as AIA  
> intermediate CA cert retrieval.

Why is Opera doing something as extremely dangerous as intermediate CA Cert
retrievel based on AIA?

In the original design, the certificate path validation algorithm
described in rfc-5280 works from the trust anchor downwards to the
end entity cert -- which makes a lot of sense security-wise.

Using any information in certificates that have not been verified to
perform resource-intensive operations is a security problem.  But
accessing an arbitrary URL presented in an completely unverified
End-Entity certificate is a "Freddy Krueger" waiting for his next victim. 

-Martin