Subject: [pkix] OCSP reponses without nexUpdate

From: Thomas Kopp <[email-masked]>
Date: Mon, 24 Feb 2020 07:53:58 +0000

Dear all,

OCSP real time responders typically produce responses without a nextUpdate. RFC 6960 stipulates in section 4.2.2.1 that ...

If nextUpdate is not set, the responder is indicating that newer revocation information is available all the time.

It seems that the former wording is ambiguous with regard to the semantics of the word "newer".
Does it mean for subsequent requests that one of the fields  thisUpdate or producedAt must change even if certificate status has not changed?

[LuxTrust_logo_blue_signature]
Thomas KOPP
Chief Scientist

Email: [email-masked]<mailto:[email-masked]>
Mobile:+352 621 229 316
Office: +352 26 68 15 - 574
LuxTrust S.A. |  IVY Building | 13-15, Parc d'activités | L-8308 Capellen | Luxembourg | www.luxtrust.lu<http://www.luxtrust.lu/>

<https://www.linkedin.com/company/luxtrust-s.a.>
[Banner_Email_jobs_hiring]
________________________________
The information in this e-mail and any attachment is confidential and for use by the addressee only. Access to this e-mail by anyone else is not authorized. If you are not the intended recipient, please inform the sender and erase all copies of it from your system. Internet communications are by default not secure. LuxTrust S.A. cannot guarantee the integrity and origin of e-mails unless they have been properly digitally signed. Confidentiality of e-mails can only be guaranteed if they are encrypted properly using a secure digital certificate.LuxTrust S.A. takes precautions to ensure that e-mails are scanned for viruses but cannot accept liability for any damage sustained as a result of software viruses.
________________________________

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 24 Feb 2020 09:10:47 +0000

Thomas Kopp <[email-masked]> writes:

>Does it mean for subsequent requests that one of the fields  thisUpdate or
>producedAt must change even if certificate status has not changed?

Yes, no, and maybe.  If you're applying strict CRL compatibility, you set it
to the CRL nextUpdate time.  If you decide that since it's an online service
another update can become available at any time, you set it the current time.
If you're running CRLs at the same time, you set it to the next CRL production
time.  If you're doing batch signing to deal with OCSP's non-scalability, in
other words pre-producing responses, you set it to when the next batch of
responses get signed.  If you believe the Martians are coming, you set it to
just before they land so there's no expectations of OCSP responses after
they've killed us all.

If you don't believe any of the above then feel free to come up with another
interpretation and use that.  See long-ago threads on this list for more
suggestions on how this field can be interpreted (I can't remember all of the
variants).

Another interpretation is to do whatever makes sense to you and put it in your
CPS.

Peter.

---

From: Thomas Kopp <[email-masked]>
Date: Mon, 24 Feb 2020 11:27:18 +0000

Thanks a lot Peter for this obviously very flexible interpretation of the RFC's "newer" semantics.
Hopefully also others, in particular authors of RFC 6960, might provide some complementary advice.

Thomas KOPP
Chief Scientist

Email: [email-masked]
Mobile:+352 621 229 316
Office: +352 26 68 15 - 574
LuxTrust S.A. |  IVY Building | 13-15, Parc d'activités | L-8308 Capellen | Luxembourg | www.luxtrust.lu

-----Original Message-----
From: Peter Gutmann [mailto:[email-masked]] 
Sent: Monday, February 24, 2020 10:11 AM
To: Thomas Kopp; [email-masked]
Subject: Re: OCSP reponses without nexUpdate

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 24 Feb 2020 11:29:42 +0000

The point is that no-one can agree on an interpretation, so if one person says
X then the next person you ask might say ~X.  That's why I suggested putting
it in your CPS, at least then it's documented for anyone who wants to see it.

Peter.

________________________________________
From: Thomas Kopp <[email-masked]>
Sent: Tuesday, 25 February 2020 00:27
To: Peter Gutmann; [email-masked]
Subject: RE: OCSP reponses without nexUpdate

Thomas KOPP
Chief Scientist

-----Original Message-----
From: Peter Gutmann [mailto:[email-masked]]
Sent: Monday, February 24, 2020 10:11 AM
To: Thomas Kopp; [email-masked]
Subject: Re: OCSP reponses without nexUpdate

Peter.

---

From: Thomas Kopp <[email-masked]>
Date: Mon, 24 Feb 2020 12:48:58 +0000

Indeed, this makes sense. Thanks, again!

Thomas KOPP
Chief Scientist

-----Original Message-----
From: Peter Gutmann [mailto:[email-masked]] 
Sent: Monday, February 24, 2020 12:30 PM
To: Thomas Kopp; [email-masked]
Subject: Re: OCSP reponses without nexUpdate

Peter.

Thomas KOPP
Chief Scientist

-----Original Message-----
From: Peter Gutmann [mailto:[email-masked]]
Sent: Monday, February 24, 2020 10:11 AM
To: Thomas Kopp; [email-masked]
Subject: Re: OCSP reponses without nexUpdate

Peter.