Re: POLL: Nonce-specific error code for OCSP

[Julien Pierre <jpierre@xxxxxxx>]

Florian Oelmaier wrote:

> Rationale: 
> My first idea was to say: if it is OPTIONAL for the responder to use that error code it is ok. But in fact even the OPTIONAL inclusion harms the security of the protocol, as an attacker can fool clients into believing a particular OCSP-Responder would not support nonces, when in fact it does.
Agreed. The OCSP responses with error codes are not signed, so this 
would present a security hole. We should not let the server return this 
error code in an unsigned response.

IMO, it would be acceptable to have an error code only if the response 
was signed and included a validity period. Each caching responder would 
have to prefetch such a response in order to be able to serve it back to 
clients that send nonces.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature