Re: [TLS] New version of Multiple OCSP mode of Certificate Status extension

["Brian Smith" <[e-mail]>]

Yngve Nysaeter Pettersen wrote:
> On Wed, 28 Jul 2010 23:03:44 +0200, Brian Smith <[e-mail]>
> wrote:
> > Plus, it is a privacy issue. If you rely on the CAs to provide this
> > extension in their OCSP responses, then any CAs that want OCSP traffic
> > (for user tracking) can just omit the OCSP extension. The multiple OCSP
> > method lets the server improve the user's privacy without any
cooperation
> > from the CAs involved.
> 
> This issue will not be any different from the current situation; When they
> check OCSP, clients only check the site certificate. If they check
> revocation for intermediates they use CRLs. In fact, for Opera's part, we
> retrieve CRLs while verifying the certificate, OCSP after the certificate
> has been checked, so CRLs are more "dangerous" from that perspective.

Right. What I am saying is that your proposed extension would improve on the
current situation.

> As for your MITM scenario, if the intention is to detect which computers
> access a certain site, then the attacker will already have that
> information when he performs the MITM attack.

That is true, but often the case where Eve tells Malory that Alice did
something is less problematic than the case where Eve tricks Alice into
telling Malory herself. This would be the case when the MiTM is exploiting a
vulnerability in a web browser's OCSP and/or CRL processing. But even purely
a matter of privacy, it is something that should be avoided whenever
practical.

> Opera does not send or accept cookies in OCSP/CRL requests, so there would
> be no extra information available.

It still discloses information about the user's software (browser, operating
system, and some HTTP/TLS/networking settings), information about the user's
hardware, information about the user's location (via GEO-IP targeting),
information about the site that the user is trying to contact, the time at
which the user is attempting to contact the server. Over time, the CA can
build a profile of a user--including often his employer and/or home address,
possibly even uniquely identifying the user by name--simply using
information included in "anonymous" OCSP/CRL requests. The more certificates
the CA manages, the better a profile it can build of the user, more quickly.


Consequently, anything that can prevent the user from making OCSP and CRL
requests to the CA will be a significant privacy-enhancing improvement.

Regards,
Brian