Specifically, the problems with OCSP that Adam Langley talks about here?

  • 4
    Please expand the question you're asking in the body of your post. If the link becomes invalid for any reason, no one will have any idea what problems you're referring to. – Xander Aug 4 '14 at 13:20

Revocation should be done if a certificate is comprised. In this case the valid owner of the certificate will no longer use it. Revocation checks should then make sure, that also the attacker will not be able to use it on intercepted connections.

Langley describes an attack, where the attacker is not only able to redirect the user to the attackers server with the compromised certificate, but also to block or manipulate any other connections from the victim and thus make the OCSP requests for revocation check fail with temporary errors.

OCSP stapling does not help in this case. The server with the compromised certificate is owned by the attacker so the attacker will just not do OCSP stapling, i.e. will not send an OCSP response back within the SSL handshake. This will force the victim to try with the normal OCSP queries and we are back to Langley's attack.

OCSP will only be secure if the client will only continue if it gets a valid response from the server which says that the certificate is ok and if the client can successfully verify the signature of the response. This is the same with and without OCSP stapling. OCSP stapling only speeds up the revocation checks because it saves an extra HTTP request for the OCSP check.

  • Thanks - about the compromised certificates - Langley mentions that "an attacker close to the server can get certificates issued from many CAs and deploy different certificates as needed." How exactly does the attacker "get" these certificates? I assume we are talking here about certs such as MD2/5, etc...which have been known to allow an attacker to fake a website? – user53029 Aug 3 '14 at 17:56
  • I think this just means, that an attacker close to the server can get another certificate for the same server from a different CA. Usually verification is only done by unsafe e-mail and an attacker close to the server might intercept these e-mails.And in this case the attacker would have a real certificate for the domain, so there is no need to use the compromised certificate and deal with revocation checks. – Steffen Ullrich Aug 3 '14 at 17:59
  • OCSP stapling also provides more privacy. – user49075 Aug 3 '14 at 20:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.