RFC 4806

Online Certificate Status Protocol (OCSP) Extensions to IKEv2

📅 published February 2007, from ietf

Online Certificate Status Protocol (OCSP) Extensions to IKEv2 💖

Okay bestie, this is RFC 4806 🎀 It's a Standards Track document from the Network Working Group, dated February 2007, written by M. Myers (TraceRoute Security LLC) and H. Tschofenig (Siemens Networks GmbH & Co KG). Its header doesn't list anything it obsoletes or updates, so there's nothing to chase there 🧚

Table of Contents 📑

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  3
   3.  Extension Definition . . . . . . . . . . . . . . . . . . . . .  4
     3.1.  OCSP Request . . . . . . . . . . . . . . . . . . . . . . .  4
     3.2.  OCSP Response  . . . . . . . . . . . . . . . . . . . . . .  5
   4.  Extension Requirements . . . . . . . . . . . . . . . . . . . .  5
     4.1.  Request for OCSP Support . . . . . . . . . . . . . . . . .  5
     4.2.  Response to OCSP Support . . . . . . . . . . . . . . . . .  6
   5.  Examples and Discussion  . . . . . . . . . . . . . . . . . . .  6
     5.1.  Peer to Peer . . . . . . . . . . . . . . . . . . . . . . .  6
     5.2.  Extended Authentication Protocol (EAP) . . . . . . . . . .  7
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . .  8
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . .  9
   8.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . .  9
   9.  Normative References . . . . . . . . . . . . . . . . . . . . .  9

Status of This Memo 🌸

This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💅

Copyright Notice ©️

Abstract 🦋

IKEv2 supports public key based authentication, but using in-band Certificate Revocation Lists (CRL) for that is a problem, because CRL size is unbounded 😭 An Online Certificate Status Protocol (OCSP) response, on the other hand, is well-bounded and small ✨ This document defines the "OCSP Content" extension to IKEv2. A CERTREQ payload with "OCSP Content" identifies zero or more trusted OCSP responders, and it's a request to include an OCSP response in the IKEv2 handshake. A cooperative recipient of that request responds with a CERT payload holding the right OCSP response. That content is recognizable by the same "OCSP Content" identifier 🎀

When you use certificates with IKEv2, the peers need a way to figure out whether the other peer's certificate has been revoked. OCSP is one way to do that. This document is for when OCSP is wanted and security policy stops one of the IKEv2 peers from reaching the relevant OCSP responder directly. Firewalls are often set up to block that access for IKEv2 peers outside an enterprise network 🧱

1. Introduction ✨

Version 2 of the Internet Key Exchange (IKE) protocol [IKEv2] supports a bunch of authentication mechanisms, including public key based authentication. Confirming that a certificate is reliable is essential if you want the security guarantees public key cryptography gives you. One big piece of that confirmation is checking the certificate's revocation status (see [RFC3280] for additional detail) 🔍

The traditional way to check revocation status is with Certificate Revocation Lists (CRLs). IKEv2 lets CRLs be exchanged in-band through the CERT payload 📦

The catch is that CRLs can grow unbounded in size. There are plenty of real-world examples showing that including a multi-megabyte file in an IKE exchange is impractical 💀 This is especially painful in bandwidth-limited environments (for example, mobile communications). The net effect is that in-band CRLs get ruled out in favor of out-of-band (OOB) acquisition of that data, if it's used at all 🙈

Relying on OOB methods can get even messier if reaching the revocation data requires IPsec (and therefore IKE) to set up secure and authorized access to the CRLs of an IKE participant. That kind of network access deadlock pushes people even further away from relying on certificate revocation status, and toward blind trust 😬

OCSP [RFC2560] is a useful alternative 🌈 The size of an OCSP response is bounded and small, which makes it a good fit for in-band IKEv2 signaling of a certificate's revocation status 🍓

This document defines an extension to IKEv2 that enables the use of OCSP for in-band signaling of certificate revocation status. A new content encoding is defined for use in the CERTREQ and CERT payloads. A CERTREQ payload with "OCSP Content" identifies zero or more trusted OCSP responders and is a request to include an OCSP response in the IKEv2 handshake. A cooperative recipient of that request responds with a CERT payload containing the appropriate OCSP response. That content is recognizable by the same "OCSP Content" identifier 💜

2. Terminology 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🫶

This document defines the following terms:

OCSP request: an OCSP request is the CERTREQ payload that contains a new content encoding, called OCSP Content, which conforms to the definition and behavior specified in Section 3.1.

OCSP response: an OCSP response is the CERT payload that contains a new content encoding, called OCSP Content, which conforms to the definition and behavior specified in Section 3.2.

OCSP responder: the OCSP responder is the entity that accepts requests from an OCSP client and returns responses, as defined in [RFC2560]. Heads up: the OCSP responder is not the party that sends the CERT message 👀

3. Extension Definition 🎀

Referring to Section 3.6 of [IKEv2], the values for the Cert Encoding field of the CERT payload get extended like this (see also the IANA Considerations section of this document):

               Certificate Encoding               Value
               --------------------               -----
               OCSP Content                        14

3.1. OCSP Request 💌

A value of OCSP Content (14) in the Cert Encoding field of a CERTREQ Payload means there are zero or more OCSP responder certificate hashes in the Certificate Authority field of the CERTREQ payload. Section 2.2 of [RFC2560] defines responses, which fall into one of three groups:

(a) the CA who issued the certificate
(b) a Trusted Responder whose public key is trusted by the requester
(c) a CA Designated Responder (Authorized Responder) who holds a specially marked certificate issued directly by the CA, indicating that the responder may issue OCSP responses for that CA

For (a), the hashes in the CERTREQ message aren't needed, because the CA who issued the certificate signs the OCSP response. For (c), the CA Designated Responder signs the OCSP response, and the sender of the CERTREQ message doesn't know that public key ahead of time. The presence of OCSP Content in a CERTREQ message identifies one or more OCSP responders trusted by the sender in case (b) 🧠

When OCSP Content (14) shows up in a CERTREQ message, it:

identifies zero or more OCSP responders trusted by the sender;
notifies the recipient of sender's support for the OCSP extension to IKEv2; and
notifies the recipient of sender's desire to receive OCSP confirmation in a subsequent CERT payload.

3.2. OCSP Response 🦋

A value of OCSP Content (14) in the Cert Encoding field of a CERT Payload means an OCSP response is present in the Certificate Data field of the CERT payload.

You can correlate an OCSP response CERT payload with a matching CERT payload that carries a certificate by matching the OCSP response CertID field to that certificate. See [RFC2560] for the definition of OCSP response content ✨

4. Extension Requirements 📋

4.1. Request for OCSP Support 🔥

Section 3.7 of [IKEv2] lets you concatenate trust anchor hashes into the Certification Authority value of a single CERTREQ message. The problem is there's no way to tell which of those hashes, if any, belongs to a trusted OCSP responder's certificate 😵‍💫

So an OCSP request, as defined in Section 3.1 above, is sent separately from any other CERTREQ payloads in an IKEv2 exchange.

When it's useful to identify more than one trusted OCSP responder, each of those identifications SHALL be concatenated the same way Section 3.7 of [IKEv2] describes for assembling multiple trust anchor hashes.

The Certification Authority value in an OCSP request CERTREQ SHALL be computed and produced the same way as trust anchor hashes, as documented in Section 3.7 of [IKEv2].

When an OCSP response CERT payload comes back for a prior OCSP request CERTREQ, the CERTREQ sender SHALL fold the OCSP response into its path validation logic, as defined by [RFC3280] 🫧

Heads up: if you send an OCSP request CERT payload and no OCSP response CERT payload comes back, that might mean this OCSP extension isn't supported on the other side. So it is recommended that nodes be configured to require a response only if it's known that all peers really do support this extension. Otherwise, it is recommended that the nodes be configured to try OCSP and, if there's no response, work out the certificate revocation status some other way 🙏

4.2. Response to OCSP Support 🌷

When the recipient gets an OCSP request CERTREQ payload, it SHOULD acquire the related OCSP-based assertion, then produce and transmit an OCSP response CERT payload for the certificate it needs to verify the signature on IKEv2 payloads 🪄

An OCSP response CERT payload is sent separately from any other CERT payload in an IKEv2 exchange.

How an OCSP response gets acquired so it can be turned into an OCSP response CERT payload is out of scope for this document 🚫

The Certificate Data field of an OCSP response CERT payload SHALL contain a DER-encoded OCSPResponse structure, as defined in [RFC2560] 💖

5. Examples and Discussion 🎬

This section shows the standard IKEv2 message examples with both peers, the initiator and the responder, using public key based authentication, CERTREQ and CERT payloads. The first instance corresponds to Section 1.2 of [IKEv2], and the illustrations from there are reproduced below for reference. (The message diagrams are coming up in the next part, so stay tuned 🧚🌈)

5.1. Peer to Peer 🦋

okay so let's look at how the IKEv2 extensions from this doc play out in the peer-to-peer exchange from Section 1.2 of [IKEv2] 💅 the messages are numbered so we can point at them, bestie

     Initiator                             Responder
     -----------                           -----------
(1)  HDR, SAi1, KEi, Ni              -->

(2)                                  <-- HDR, SAr1, KEr, Nr,
                                         CERTREQ(OCSP Request)
(3)  HDR, SK {IDi, CERT(certificate),-->
     CERT(OCSP Response),
     CERTREQ(OCSP Request),
     [IDr,] AUTH, SAi2, TSi, TSr}

(4)                                  <-- HDR, SK {IDr,
                                         CERT(certificate),
                                         CERT(OCSP Response),
                                         AUTH, SAr2, TSi, TSr}

                  OCSP Extensions to Baseline IKEv2

so in (2) the Responder sends a CERTREQ payload that's an OCSP request, and it names zero or more OCSP responders it trusts 🫶 then the Initiator replies in (3) with two things: a CERT payload holding its own certificate, and an OCSP response CERT payload covering that certificate. the Initiator also asks for an OCSP response in (3), using an OCSP request CERTREQ payload. then in (4) the Responder sends back its certificate plus a separate OCSP response CERT payload covering that certificate 🎀

now the plot twist 😭 in (2), the Responder doesn't have the Initiator's certificate yet, so it can't build an OCSP request the way [RFC2560] describes. the fix is to use hashes, as defined in Section 4.1. so the OCSP Requests are basically just index values pointing into that data 🧚 which means it's easy to see that OCSP responses can get made even when there's no matching request, as long as OCSP nonces aren't used (more on that in Section 6) 🙈

there's one more thing. for this to work, the Initiator needs to be sure the Responder can do this and is willing to. the Responder also only trusts one or more OCSP responder signatures. those are the reasons the OCSP responder hash extension exists 👑

5.2. Extended Authentication Protocol (EAP) 🌈

next up is EAP, which is a super important use case 💜 it lets lots of end users get enterprise access to an IPsec gateway. quick note: OCSP is only used to check the status of the server side IKEv2 certificate. it is NOT used for certificates that might show up inside EAP methods, whether the EAP peer or the EAP server is holding them 🙅‍♀️ same as the last section, this illustration is taken from [IKEv2]. if this doc and [IKEv2] ever disagree about these illustrations, [IKEv2] SHALL dominate 👑

     Initiator                            Responder
     -----------                          -----------
(1)  HDR, SAi1, KEi, Ni              -->
(2)                                  <-- HDR, SAr1, KEr, Nr
(3)  HDR, SK {IDi,                   -->
     CERTREQ(OCSP Request),
     [IDr,] AUTH, SAi2, TSi, TSr}
(4)                                  <-- HDR, SK {IDr,
                                         CERT(certificate),
                                         CERT(OCSP Response),
                                         AUTH, EAP}
(5)       HDR, SK {EAP}              -->

(6)                                  <-- HDR, SK {EAP (success)}

(7)       HDR, SK {AUTH}             -->

(8)                                  <-- HDR, SK {AUTH, SAr2, TSi,
                                         TSr }

                   OCSP Extensions to EAP in IKEv2

in the EAP flow, messages (5) through (8) aren't relevant to this document 🦋

6. Security Considerations 🔥

okay this section is serious, so buckle up 😭 for the reasons already covered, an OCSP request (as defined in Section 3.1) is used in place of an OCSP request syntax to trigger the making and sending of an OCSP response. regular OCSP, as defined in [RFC2560], can include a nonce request extension, which helps protect against replay attacks (see Section 4.4.1 of [RFC2560] for the details). the OCSP request in this doc can't carry nonces. [RFC2560] handles this by allowing precomputed responses 💀

[RFC2560] itself calls out this replay problem and says: "The use of precomputed responses allows replay attacks in which an old (good) response is replayed prior to its expiration date but after the certificate has been revoked. Deployments of OCSP should carefully evaluate the benefit of precomputed responses against the probability of a replay attack and the costs associated with its successful execution."

so nodes SHOULD make the required freshness of an OCSP response configurable ⚠️ this is the kind of thing you do not want to skip, periodt 💅

⚠️ precomputed responses can be replayed. a revoked cert can look good again if an old response slips through, so keep an eye on freshness.

7. IANA Considerations 🍓

this doc defines one new field type for the IKEv2 Cert Encoding field of the Certificate Payload format ✨ the "OCSP Content" extension got an official spot in the Cert Encoding table of Section 3.6 of [IKEv2], and that assignment was acquired from IANA 🎀

Certificate Encoding               Value
--------------------               -----
OCSP Content                        14

8. Acknowledgements 🫶

the authors want to thank Russ Housley for his support 💖 they also thank Pasi Eronen, Nicolas Williams, Liqiang (Larry) Zhu, Lakshminath Dondeti, and Paul Hoffman for reviewing the work. Pasi gave invaluable last-call comments 🌸 Tom Taylor gets a shoutout for his Gen-ART review, and Jari Arkko gave IESG review comments 👑

9. Normative References 📚

[IKEv2]    Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
           RFC 4306, December 2005.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2560]  Myers, M., Ankney, R., Malpani, A., Galperin, S., and C.
           Adams, "X.509 Internet Public Key Infrastructure Online
           Certificate Status Protocol - OCSP", RFC 2560, June 1999.

[RFC3280]  Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
           X.509 Public Key Infrastructure Certificate and
           Certificate Revocation List (CRL) Profile", RFC 3280,
           April 2002.

Authors' Addresses 🧚

Michael Myers
TraceRoute Security LLC

EMail: mmyers@fastq.com


Hannes Tschofenig
Siemens Networks GmbH & Co KG
Otto-Hahn-Ring 6
Munich, Bavaria  81739
Germany

EMail: Hannes.Tschofenig@siemens.com
URI:   http://www.tschofenig.com

Full Copyright Statement 💜

the legal text stays exactly as written:

Copyright (C) The IETF Trust (2007).

This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.

This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🌈

the IETF doesn't take a position on whether any IPR claimed around this tech is valid or in scope, or whether licenses are available. it also doesn't say it looked for any such rights 🙈 the rules for RFC rights are in BCP 78 and BCP 79.

copies of IPR disclosures sent to the IETF Secretariat, and any licence assurances, are in the IETF online IPR repository at http://www.ietf.org/ipr. that covers any attempt to get a general licence for implementers or users too 💅

the IETF invites anyone to flag copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. send that to ietf-ipr@ietf.org 🎀

Acknowledgement ✨

funding for the RFC Editor function is currently provided by the Internet Society 💖

📦 where this page comes from

ietf: rfc4806 2007-02
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms