Re: [TLS] OCSP Stapling in RFC 6066

[[e-mail] (Martin Rex)]

Jeremy Harris wrote:
> Fries, Steffen wrote:
>> I've got a question to the OCSP stapling approach described in RFC 6066
> 
> Why not jump directly to an RFC 6961 analogue?

Your observation is correct that the rfc6066 OCSP extension is limited
to a single OCSP response for the server certificate, whereas the
TLS extension defined in rfc6961 allows for multiple OCSP responses,
including OCSP responses for CA certificates in the certificate
chain of the server.

But there are a number of differences in the server and client
authentication that make these two TLS extensions (or their approach)
a bad fit for client certificate authentication.

For the server certificate, the Server's decision/choice for a specific
server certificate happens (or at least can happen) while the server
evaluates the TLS protocol options proposed in ClientHello and
composed the ServerHello response _after_ making the selections of
TLS protocol options.  So when the server composes the ServerHelloExtensions
it knows which server certificate it is going to use and can insert
the respective OCSP responses into ServerHello.

The situation is substantially different for the client, who has to
include all TLS protocol options that are up for negotation upfront
in ClientHello(Extensions).  At this point, the client does not know
whether the server is going to request a client certificate at all,
nor does the client know, which list of trusted certification_authorities
or which algorithms the server supports and is going to select/request.

So the approach for conveying OCSP responses for the client certificate
from the client to the server should probably be on the second batch
of handshake messages from client to server in a full TLS handshake,
such as using a "TLS Handshake Message for Supplemental Data" (rfc4680).
I agree that the rfc4680 approach is more code to implement, but
such an approach would not break when the client has more than one
client certificates or additional client certificates other than X.509.


-Martin