RE: OCSP response pre-production

["Manger, James H" <James.H.Manger@xxxxxxxxxxxxxxxx>]

Clients may prefer a nonce-based (not clock-based) freshness guarantee when available.  Clients may also be willing to accept cache-only responders (with their clock-based freshness) when necessary, as they can offer advantages for large-scale systems.

Clients may want both these options, but they do not want to allow an attacker to choose when the "downgrade to cache-only" occurs.


A solution:
1) Responders that can include the request nonce in the response MUST indicate this capability.  Including the nonce extension in the response (even if the request didn't have one) seems like a reasonable way to indicate this.
2) If a request includes a nonce a client MUST reject the response if it also contains a nonce but that nonce has a different value.
3) Client MUST NOT reject responses with nonces just because the request didn't include a nonce.

Note: Dynamic responders can still cache responses with nonces to respond to subsequent nonceless requests.
Note: Cache-only systems can pre-produce responses without nonces to respond to any request.


I suspect current clients already do 2) & 3).  Perhaps only Florian's responder currently does 1), but this is not a huge problem.  Clients that support "downgrade to cache-only iff that is all that is available" can be configured for this on a per-responder basis if necessary.



(So I don't like Denis's "New text proposal")


-----Original Message-----
From: Denis Pinkas [mailto:Denis.Pinkas@xxxxxxxx]
Sent: Monday, 29 September 2003 8:07 PM
To: Deacon, Alex
Cc: ietf-pkix@xxxxxxx
Subject: Re: OCSP response pre-production (was RE: POLL: Use of nonces
in OCSP)

...
New text proposal:

     "Upon receipt of a request containing a nonce,
      a responder SHALL include the value of such nonce
      in the production of the associated response,
      if it is not using cached pre-produced responses.
      If the responder is using cached pre-produced responses,
      then it MAY send back a response with or without a nonce."

      "Clients that elect to include a request nonce
      MAY reject responses that fail to include
      the client's nonce from the associated request.
      Alternatively they MAY ignore the nonce field and accept
      the response, if they have a local trusted clock and are
      satisfied with the time difference between their local
      trusted clock and the producedAt field from ResponseData".