IETF Logo Mail Archive

Re: [TLS] [pkix] New version of Multiple OCSP mode of Certificate Status extension

Dr Stephen Henson <lists@drh-consultancy.demon.co.uk> Thu, 05 August 2010 18:50 UTC

Return-Path: <lists@drh-consultancy.demon.co.uk>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCCB03A6A74; Thu, 5 Aug 2010 11:50:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m8cBgGGc8XX4; Thu, 5 Aug 2010 11:50:35 -0700 (PDT)
Received: from claranet-outbound-smtp03.uk.clara.net (claranet-outbound-smtp03.uk.clara.net [195.8.89.36]) by core3.amsl.com (Postfix) with ESMTP id CD3ED3A6A2D; Thu, 5 Aug 2010 11:50:34 -0700 (PDT)
Received: from drh-consultancy.demon.co.uk ([80.177.30.10]:55260 helo=[192.168.7.8]) by relay03.mail.eu.clara.net (relay.clara.net [213.253.3.43]:10587) with esmtpa (authdaemon_plain:drh) id 1Oh5Wt-0002JX-9s (return-path <lists@drh-consultancy.demon.co.uk>); Thu, 05 Aug 2010 18:50:59 +0000
Message-ID: <4C5B0814.1060503@drh-consultancy.demon.co.uk>
Date: Thu, 05 Aug 2010 19:51:00 +0100
From: Dr Stephen Henson <lists@drh-consultancy.demon.co.uk>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6
MIME-Version: 1.0
To: Rob Stradling <rob.stradling@comodo.com>
References: <E1OfxqR-00006L-FJ@wintermute02.cs.auckland.ac.nz> <201008032046.38830.rob.stradling@comodo.com> <op.vgw4c3czvqd7e2@killashandra.oslo.osa> <201008042304.05996.rob.stradling@comodo.com>
In-Reply-To: <201008042304.05996.rob.stradling@comodo.com>
X-Enigmail-Version: 1.0.1
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Cc: pkix@ietf.org, tls@ietf.org
Subject: Re: [TLS] [pkix] New version of Multiple OCSP mode of Certificate Status extension
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Aug 2010 18:50:39 -0000

On 04/08/2010 23:04, Rob Stradling wrote:
> On Wednesday 04 August 2010 15:40:05 Yngve Nysaeter Pettersen wrote:
>> On Tue, 03 Aug 2010 21:46:38 +0200, Rob Stradling
>>
>> <rob.stradling@comodo.com> wrote:
>>> In another thread, Kyle H today wrote:
>>> "...why not change the ASN.1 to allow for multiple individual responses
>>> in a
>>> SEQUENCE or SET?"
>>
>> I suspect that this is about responses for multiple certificates for the
>> same issuer.
> 
> I suspect not.  BasicOCSPResponse already allows a single Response to contain 
> status information about multiple certificates for the same issuer.
> 
> In fact, BasicOCSPResponse already allows a single Response to contain status 
> information about multiple certificates from *multiple issuers*.  The problem, 
> of course, is that a BasicOCSPResponse may only be signed by a single entity, 
> so this kind of Response could only ever be useful in a "local configuration 
> of OCSP signing authority" (RFC 2560 section 4.2.2.2 option 1) context.
> 

I can recall this being mentioned before and the possibility was mentioned that
it might be permitted if you had the same public key in multiple delegated
signer certificates for each issuer.

I'm not sure how many OCSP clients would correctly handle that case, the current
OpenSSL OCSP code can't for one.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: shenson@drh-consultancy.co.uk, PGP key: via homepage.

v2.23.0 | Report a Bug | By Email