Re: [TLS] [pkix] New version of Multiple OCSP mode of Certificate

[Nicolas Williams <[e-mail]>]

On Fri, Aug 06, 2010 at 02:40:36AM +1200, Peter Gutmann wrote:
> Nicolas Williams <[e-mail]> writes:
> 
> >What can be done to improve the AIA situation is to constraint AIA URLs such
> >that, for example, they cannot specify arbitrary port numbers, and to very
> >few URL schemes (HTTP and LDAP should suffice).
> 
> The problem with this is that you now get into the URL-obfuscation arms race
> that the malware industry has been playing with browser developers for the
> last ten years or so.  Would you trust a random PKI implementation (written by
> crypto developers not web developers and that's never had to deal with this
> kind of attack) to get this right?  After the third attempt?  After the tenth
> attempt?

The constraint can be such that only a hostname can be provided.  For
HTTP a well-known URL local part would then be used (see host-meta for
well-known stuff).  For LDAP we might say that you have to do a
particular search against only the base DNs corresponding to the
namingContexts listed in the root DSE.

Nico
--