Man-in-the-middle attacks (was: OCSP response pre-production)

[Paul Hoffman / IMC <phoffman@xxxxxxx>]

The problem I am seeing with the proposals that it is OK for the 
responder to send nonce-less responses to queries with nonces is that 
it allows a man-in-the-middle to perform a fairly trivial replay 
attack. A sophisticated man-in-the-middle might capture every 
request, strip out the nonce (and signature, if any), pass it on to 
the server, and then send back all the responses with no nonces, so 
that the client expects no nonces from the server and won't be at all 
suspicious when snookered with a replay attack.

If we go for the minority proposal of allowing responders to ignore 
nonces in the queries, we will certainly need to beef up the Security 
Considerations section, and probably section 4.4.1 as well.

--Paul Hoffman, Director
--Internet Mail Consortium