Re: [TLS] draft-ietf-tls-cached-info-14

[[e-mail] (Martin Rex)]

Yngve N. Pettersen wrote:
> 
> My advice: Keep cache lists for each server separate from the lists used  
> for other servers. That does not mean that the client cannot optimize  
> storage by combining the storage for each entry in the list, though. There  
> is too much chance of guessing wrong about what the server should know  
> based on what the client knows.

I agree with Yngve that it would be a terribly bad idea for TLS clients
to announcing hashes of cached OCSP responses from other sources than
a prior TLS handshake with the _exact_same_server_ .

The concept of the caching mechanism is to cache data from a previous
TLS handshake.  Mixing in data from other sources is going to cause
hardly predictable behaviour *AND* is going to leak information that
ought not to be leaked (and may occasionally create a security problem
"side channel").

The only thing that might be acceptable, is a means for the client to
indicate "don't send me that information at all".  The client could
always omit the OCSP response extension (single and multi) from the
TLS ClientHello, if it so desires (e.g. in a renegotiation handshake,
if the client would also abort on a change of the server certificate).

But even then, when the "I already have this information" is the result
of TLS handshakes with another server, the result would be a side channel
leaking information -- so TLS clients need to be careful here!

-Martin