Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of the certificate.

What mitigations are there to prevent OCSP replay attacks on a client that doesn't support NONCES?

More info:

From what I can tell all software that relies on the verification process in CryptoAPI works this way. I believe this includes:

  • IE (SSL and client certs)
  • .NET network bindings (WCF, HTTPS, WebClient)
  • Smart Cards
  • SMIME
  • among many others...
share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Rook, Chrome on Windows uses CryptoAPI on other platforms they use NSS but NSS's revocation platform isn't "Faster" and doesnt send nonces (by default) either - its actually the least performant and robust revocation implementation of all the browsers.

There are a bunch of pending improvements to the NSS revocation behavior that should fix this in the near future.

We offer OCSP services for our products, one of the larger pool of responders on the internet; the number of requests we get with nonces approaches 0 (almost none).

makerofthings - Java applications will each behave differently, its possible to get Java to send nonces, sign requests, etc; its all up to the application.

As for the original request, there is limited protection to replays based on time (see security considerations in - http://www.ietf.org/rfc/rfc5019.txt). Supporting nonces also requires dynamically signing OCSP responses, Symantec issues 3 billion OCSP responses a day under normal load and this is with cached responses. Introducing dynamic signing would both be several orders of magnitude more expensive to operate (especially globally) but also expose them to a trivial resource consumption DOS.

Nonces make the most sense in the enterprise where signed requests also have a chance of working, if you want to use them you should look at installing a revocation provider in windows like the Axway desktop validator.

@rmhrisk

share|improve this answer
    
Hello Ryan, welcome to Security.SE. By "our products" do you mean Microsoft? –  makerofthings7 Jun 11 '12 at 16:01
    
Sorry, I am the CTO of GlobalSign. In a past life I worked at Microsoft on this area. –  user10546 Jun 11 '12 at 20:50
add comment

Chrome and Firefox have their own OCSP implementations. Firefox has this enabled by default, where as chrome has their own CRL system which is much faster and isn't subject to a replay attack. You can enable Chrome's OCSP support in the configuration menu.

share|improve this answer
    
That is a good workaround for many Browser Based apps. All that leaves is anything that relies on CryptoAPI (.NET client/server apps, WCF) Not sure how Java bahaves –  makerofthings7 Jun 8 '12 at 1:29
    
Any links or information about how Firefox or Chrome does its revocation in depth would be good. I don't want to end up downgrading my security for the particular scenarios I care about, which may or may not include popular sites that Google monitors. –  makerofthings7 Jun 8 '12 at 1:42
    
@makerofthings7 dude i'm not going to write your blog for you. –  Rook Jun 8 '12 at 2:46
    
For what it's worth, I don't have a blog (otherwise I'd link to it on my profile here). I just spend my time on StackExchange and a few other spots. –  makerofthings7 Jun 8 '12 at 3:28
1  
Please try to stay constructive. I don't see anything unreasonable in makerofthings7's query that would merit aggressive remarks. Thank you! –  D.W. Jun 8 '12 at 16:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.