Subject: A question about RFC-2560 (OCSP)

From: "Yasir Khan" <[email-masked]>
Date: Tue, 1 Jul 2003 14:59:34 +0500

Hi,

I have a question about 'Signed Response Acceptance Requirements' in RFC-2560 (OCSP), I am quoting the part of the document related to my question. 

3.2  Signed Response Acceptance Requirements

   Prior to accepting a signed response as valid, OCSP clients SHALL confirm that:

   1. The certificate identified in a received response corresponds to that which was identified in the corresponding request;
   2. The signature on the response is valid;
   3. The identity of the signer matches the intended recipient of the request.
   4. The signer is currently authorized to sign the response.
   5. The time at which the status being indicated is known to be correct (thisUpdate) is sufficiently recent.
   6. When available, the time at or before which newer information will be available about the status of the certificate (nextUpdate) is greater than the current time.

Requirement 4 is very ambiguous, there comes many possibilities to satisfy this requirement e.g.

a) EKU in signer certificate must contain OCSPSigning
b) Signer certificate is not revoked
c) Signer certificate is issued by the same CA that issed the target certificate to be checked for revocation
d) Issuer of the signer certificate is explicitly trusted 

I want to know the exact check(s) to satisfy the requiremtent 4.

Thanx,

Regards,
Yasir Khan
www.ascertia.com

---

From: "Ambarish Malpani" <[email-masked]>
Date: Thu, 3 Jul 2003 09:04:06 -0700

Hi Yasir,
    The client needs to "know" that it can trust the signer. This trust can
happen
in one of 3 ways:

1. The CA signs the response
2. The CA delegates signing authority to a VA to sign the response
3. The client has a separate signing relationship with a VA who does
validation for it. In this case the signer is authorized to sign because
of a private relationship between the client and the VA.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani                                          650.759.9045
Malpani Consulting Services
[email-masked]                         http://www.malpani.biz

  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On
Behalf Of Yasir Khan
  Sent: Tuesday, July 01, 2003 3:00 AM
  To: [email-masked]
  Subject: A question about RFC-2560 (OCSP)

  Hi,

  I have a question about 'Signed Response Acceptance Requirements' in
RFC-2560 (OCSP), I am quoting the part of the document related to my
question.

     Prior to accepting a signed response as valid, OCSP clients SHALL
confirm that:

     1. The certificate identified in a received response corresponds to
that which was identified in the corresponding request;
     2. The signature on the response is valid;
     3. The identity of the signer matches the intended recipient of the
request.
     4. The signer is currently authorized to sign the response.
     5. The time at which the status being indicated is known to be correct
(thisUpdate) is sufficiently recent.
     6. When available, the time at or before which newer information will
be available about the status of the certificate (nextUpdate) is greater
than the current time.

  Requirement 4 is very ambiguous, there comes many possibilities to satisfy
this requirement e.g.

  a) EKU in signer certificate must contain OCSPSigning
  b) Signer certificate is not revoked
  c) Signer certificate is issued by the same CA that issed the target
certificate to be checked for revocation
  d) Issuer of the signer certificate is explicitly trusted

  Thanx,

  Regards,
  Yasir Khan
  www.ascertia.com