Re: [TLS] New version of Multiple OCSP mode of Certificate Status

[Martin Rex <[e-mail]>]

Yngve N. Pettersen wrote:
> 
> Opera only accepts these certificates if they chain to an already known  
> and trusted Root, and verify successfully once the chain is completed.  
> Should the downloaded certificate turn out to be a Root it is  
> automatically discarded. If they pass all of this, the certificate is  
> cached.

As far as the AIA vulnerability is concerned, you're 0wnd as soon
as your software connects to the crafted URL in the crafted server
certificate.  It doesn't matter that whether you discard the reply
and abort the original browser connection at that point.  If you're
attacked, that URL is often not going to result in a certificate anyway.

> 
> The only other alternatives are to either display a certificate warning  
> for those sites, or ship with every intermediate in the Root repository.

How about warning on first encounter and offer the User to download
and memorize the intermediate cert -- or to NOT download?

> 
> As for danger, I would think that it is no more dangerous than going to  
> arbitrary websites are already, or downloading OCSP and CRLs (which are  
> also specified in the certificate).

As previously described, the certificate path validation algorithm
specified in rfc-5280 works from the trust anchor downwards to
the End Entity cert, and will reliably protect you from accessing
OCSP or CRL information from untrusted/unverified certificates.

AIA retrieval works upwards with information from completely unverified
and untrusted certs.


-Martin