Re: [TLS] Status of X.509v3 TLS Feature Extension?

[[e-mail] (Martin Rex)]

Viktor Dukhovni wrote:
>
>Salz, Rich wrote:
>> 
>> Well RFC 6066 says "only one OCSP response may be sent" and while
>> RFC 2560 allows multiple answers, it says that they are a "response
>> for each of the certificates in the request."  Since the server's
>> SSL cert is implied by 6066, and since there is no other way to
>> specify additional certs, then the answer to your questions would
>> be "just the leaf."
> 
> Which leaves the intermediate CAs out of scope...  I plan to continue
> to treat CRLs, OCSP and OCSP stapling as variants of the emperor's
> new clothes.

There exist 2 different TLS extension for OCSP responses.

Old Single OCSP response:  rfc6066 (originally defined in rfc3546)

New Multiple OCSP responses: rfc6961 

https://tools.ietf.org/html/rfc6961


>>Viktor Dukhovni wrote:
>>> 
>>> What's the point if it does not fail-closed?  The client insists
>>> that the server provide an OCSP response, but then does not validate
>>> it (some notion of freshness is surely part of validation, but no
>>> freshness algorithm is indicated).

With fail-closed you probably mean "fail-hard"?

EV certs seem to be able to provide a benefit without "fail-hard".

It is difficult to define a global/universal guaranteed service
quality for the OCSP responder service of the CA, and it is
difficult to define a minimum service quality for the server,
in which time an admin will notice and fix a problem with the
OCSP response refreshing of his server.

It is really a client-side local policy issue.  The client could
also perform OCSP request itself for the server's cert (chain),
whenever it does not consider the server's response "fresh enough".


There are two possible "attack" scenarios:

(1) the attacker steals (or breaks) the server's real key&cert,
    so that the Certificate extension will indicate whatever the
    original admin requested when he purchased the certificate

(2) the attacker manages to subvert the RA process of a public CA
    and gets a different cert without the certificate extension issued.

A fail-hard on the certificate extension can not protect you from (2).


-Martin