RFC 6277

Online Certificate Status Protocol Algorithm Agility

📅 published June 2011, from ietf

RFC 6277: Online Certificate Status Protocol Algorithm Agility ✨🎀

Okay bestie, this one's from June 2011 and it's the Standards Track doc from the IETF 🦋. The authors are S. Santesson (3xA Security) and P. Hallam-Baker (Default Deny Security), and it's an Updates: 2560 situation, so it patches the original OCSP spec, RFC 2560. It's an ISSN 2070-1721 document, and the ISSN is what it is 💅.

Abstract

OCSP needs servers to sign their responses, but it never says how the server should pick which signature algorithm to use 🥺. That can cause avoidable interop fails wherever several signature algorithms are floating around. This doc lays out rules for how a server picks its signature algorithm, plus an extension that lets a client tell the server which signature algorithms it supports 💜.

Status of This Memo

This is an Internet Standards Track doc. It's a product of the IETF, so it reflects what the IETF community agreed on, got public review, and was approved by the IESG. If you want more on Internet Standards, check Section 2 of RFC 5741 📚. For the current status, errata, and where to send feedback, go to http://www.rfc-editor.org/info/rfc6277 🧚.

Copyright Notice

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info as of the publication date. Read those carefully, because they spell out your rights and restrictions for this doc. If you pull Code Components out of this doc, they must include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, just like the Simplified BSD License says ⚠️.

   1. Introduction ....................................................2
      1.1. Requirements Language ......................................3
   2. OCSP Algorithm Agility Requirements .............................3
   3. Updates to Mandatory and Optional Cryptographic Algorithms ......4
   4. Client Indication of Preferred Signature Algorithms .............4
   5. Responder Signature Algorithm Selection .........................5
      5.1. Dynamic Response ...........................................5
      5.2. Static Response ............................................6
   6. Acknowledgements ................................................6
   7. Security Considerations .........................................6
      7.1. Use of Insecure Algorithms .................................6
      7.2. Man-in-the-Middle Downgrade Attack .........................7
      7.3. Denial-of-Service Attack ...................................7
   8. References ......................................................7
      8.1. Normative References .......................................7
      8.2. Informative References .....................................8
   Appendix A.  ASN.1 Modules .........................................9
      A.1. ASN.1 Module ...............................................9
      A.2. 1988 ASN.1 Module .........................................10

1. Introduction ✨

OCSP ([RFC2560]) is the protocol for getting certificate status info from an online service 🔍. The OCSP responder might have an OCSP responder certificate issued by the certification authority (CA) that issued the cert being checked, or it might not 🤷‍♀️. Responders can either hand out pre-signed OCSP responses or sign responses when someone asks.

RFC 2560 [RFC2560] tells a responder how to indicate which signature and digest algorithms it used in a response, but it doesn't say how those algorithms get specified 🙃. The only algorithm rules in that spec are that the OCSP client SHALL support the Digital Signature Algorithm (DSA) sig-alg-oid from Section 7.2.2 of [RFC2459], and it SHOULD be able to process RSA signatures from Section 7.2.1 of [RFC2459]. The only rule for responders in RFC 2560 is that they SHALL support the SHA1 hashing algorithm 💅.

This doc sets rules for how a server picks its signature algorithm, and it adds an extension so a client can tell the server which signature algorithms it supports 💖.

1.1. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖.

2. OCSP Algorithm Agility Requirements

Here's the problem 😭. Algorithms besides the mandatory ones are allowed, and a client currently has no way to say what it prefers. So there's always a risk that a server picks a non-mandatory algorithm and sends a response the client can't handle 💀.

A responder can have rules for picking algorithms, like using whatever signature algorithm the CA uses to sign CRLs (certificate revocation lists) and certificates 🧐. But those rules can break in pretty common situations:

The algorithm used to sign the CRLs and certificates might not match the key pair the OCSP responder uses to sign responses.
A request for an unknown certificate gives the responder no basis for choosing between multiple algorithm options.

Without changing the protocol, the second problem can't be fixed with the in-band signaling from RFC 2560 [RFC2560] 🙈.

A responder might also want different signature algorithms from the ones the CA uses to sign certificates and CRLs, for a few reasons 🌸:

The responder might use an algorithm for certificate status responses that's less computationally demanding than the one for signing the certificate itself.
An implementation might want to protect against a compromise caused by a signature algorithm getting broken, by using two separate signature algorithms.

This doc describes:

A mechanism that lets a client indicate its set of preferred signature algorithms.
Rules for signature algorithm selection that maximize the odds of successful operation when no supported preferred algorithm(s) are specified 🎯.

3. Updates to Mandatory and Optional Cryptographic Algorithms

This section updates Section 4.3 ("Mandatory and Optional Cryptographic Algorithms") of RFC 2560 [RFC2560] 🛠️.

The old version said that clients requesting OCSP services SHALL be able to process responses signed with DSA keys identified by the DSA sig-alg-oid from section 7.2.2 of [RFC2459]. Clients SHOULD also be able to process RSA signatures from section 7.2.1 of [RFC2459], and OCSP responders SHALL support the SHA1 hashing algorithm 🕰️.

The new version is way better 🔥. Clients that request OCSP services SHALL be able to process responses signed using RSA with SHA-1 (identified by the sha1WithRSAEncryption OID specified in [RFC3279]) and RSA with SHA-256 (identified by the sha256WithRSAEncryption OID specified in [RFC4055]). Clients SHOULD also be able to process responses signed using DSA keys (identified by the id-dsa-with-sha1 OID specified in [RFC3279]). Clients MAY support other algorithms too 🌈.

4. Client Indication of Preferred Signature Algorithms ✨

A client MAY declare a preferred set of algorithms in a request by putting a preferred signature algorithms extension in the requestExtensions of the OCSPRequest [RFC2560] 💜. Here's the ASN.1 for it:

     id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }

     PreferredSignatureAlgorithms ::= SEQUENCE OF
                                      PreferredSignatureAlgorithm

     PreferredSignatureAlgorithm ::= SEQUENCE {
        sigIdentifier        AlgorithmIdentifier,
        pubKeyAlgIdentifier  SMIMECapability OPTIONAL
        }

The syntax of AlgorithmIdentifier comes from Section 4.1.1.2 of RFC 5280 [RFC5280], and the syntax of SMIMECapability comes from RFC 5751 [RFC5751] 📚.

sigIdentifier is the signature algorithm the client prefers, like algorithm=ecdsa-with-sha256. For most common signature algorithms, the parameters are absent 🧁.

pubKeyAlgIdentifier is the subject public key algorithm identifier the client prefers in the server's certificate that's used to validate the OCSP response. For example, algorithm=id-ecPublicKey and parameters= secp256r1 🔐.

pubKeyAlgIdentifier is OPTIONAL. It's there so you can specify the parameters that tell apart different uses of one algorithm. A client might use it to say which curve it supports for a given elliptic curve algorithm 🌟.

The client MUST support each of the preferred signature algorithms it specifies, and it MUST list them in order of preference, from most preferred to least preferred 👑.

Section 5 of this doc explains how a server picks the algorithm to sign OCSP responses for the requesting client 🎀.

(Part 1 wraps here, part 2 picks up with Section 5 🦋💖)

6. Acknowledgements ✨

Okay bestie, huge shoutout to the people who made this happen 🫶 The authors thank Santosh Chokhani for the helpful comments on earlier drafts, Sean Turner for proposing the syntax for algorithm identifiers 💅, Jim Schaad for providing and testing the ASN.1 module in Appendix A 🧚, and Stephen Kent for valuable review and input 👑.

7. Security Considerations 🔐

Okay, this part is super serious, so let's get into it. The mechanism used to choose the response signing algorithm MUST be considered sufficiently secure against cryptanalytic attack for the intended application. No shortcuts here 😭

In most applications, it's enough for the signing algorithm to be at least as secure as the signing algorithm used to sign the original certificate whose status is being queried. BUT (and this is a big but) this criteria may not hold in long-term archival applications, where the status of a certificate is being queried for a date in the distant past, long after the signing algorithm has stopped being considered trustworthy 💀

7.1. Use of Insecure Algorithms

It's not always possible for a responder to generate a response that the client is expected to understand and that also meets contemporary standards for cryptographic security. Hard situation, ngl 🙈 In those cases, an OCSP responder operator MUST balance the risk of using a compromised security solution against the cost of mandating an upgrade. That includes the risk that the alternative end users pick will offer even less security or no security at all 😬

In archival applications, it's pretty possible that an OCSP responder gets asked to report the validity of a certificate on a date in the distant past. That certificate might use a signing method that's no longer considered acceptably secure. In that situation, the responder MUST NOT generate a signature using a signing mechanism that isn't considered acceptably secure. Absolutely not, periodt 💅

A client MUST accept any signing algorithm in a response that it specified as a preferred signing algorithm in the request. So it follows that a client MUST NOT specify a preferred signing algorithm that is either not supported or not considered acceptably secure. Rules are rules, bestie 🎀

7.2. Man-in-the-Middle Downgrade Attack

The mechanism for supporting client indication of preferred signature algorithms is NOT protected against a man-in-the-middle downgrade attack. Yikes 🙈 This isn't considered a significant security concern, though, because the OCSP responder MUST NOT sign OCSP responses using weak algorithms, even if the client asks for them. Plus, the client can reject OCSP responses that don't meet its own criteria for acceptable cryptographic security, no matter what mechanism is used to pick the response's signing algorithm 🛡️

7.3. Denial-of-Service Attack

Algorithm agility mechanisms defined in this document add a slightly bigger attack surface for denial-of-service attacks. This happens when the client request gets altered so it requires algorithms the server doesn't support 😤 Denial-of-service considerations from RFC 4732 [RFC4732] are relevant for this document too, so go check those out 🌈

8. References 📚

8.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2560]  Myers, M., Ankney, R., Malpani, A., Galperin, S., and C.
           Adams, "X.509 Internet Public Key Infrastructure Online
           Certificate Status Protocol - OCSP", RFC 2560, June 1999.

[RFC3279]  Bassham, L., Polk, W., and R. Housley, "Algorithms and
           Identifiers for the Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 3279, April 2002.

[RFC4055]  Schaad, J., Kaliski, B., and R. Housley, "Additional
           Algorithms and Identifiers for RSA Cryptography for use in
           the Internet X.509 Public Key Infrastructure Certificate
           and Certificate Revocation List (CRL) Profile", RFC 4055,
           June 2005.

[RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
           Housley, R., and W. Polk, "Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 5280, May 2008.

[RFC5751]  Ramsdell, B. and S. Turner, "Secure/Multipurpose Internet
           Mail Extensions (S/MIME) Version 3.2 Message
           Specification", RFC 5751, January 2010.

[RFC5912]  Hoffman, P. and J. Schaad, "New ASN.1 Modules for the
           Public Key Infrastructure Using X.509 (PKIX)", RFC 5912,
           June 2010.

8.2. Informative References

[RFC2459]  Housley, R., Ford, W., Polk, W., and D. Solo, "Internet
           X.509 Public Key Infrastructure Certificate and CRL
           Profile", RFC 2459, January 1999.

[RFC4732]  Handley, M., Ed., Rescorla, E., Ed., and IAB, "Internet
           Denial-of-Service Considerations", RFC 4732, December
           2006.

Appendix A. ASN.1 Modules 🧚

A.1. ASN.1 Module

 OCSP-AGILITY-2009 { iso(1) identified-organization(3) dod(6)
     internet(1)  security(5) mechanisms(5) pkix(7) id-mod(0)
     id-mod-ocsp-agility-2009-93(66) }

 DEFINITIONS EXPLICIT TAGS ::=
 BEGIN

   EXPORTS ALL;   -- export all items from this module
   IMPORTS

   id-pkix-ocsp
     FROM OCSP-2009  -- From OCSP [RFC2560]
      { iso(1) identified-organization(3) dod(6) internet(1) security(5)
        mechanisms(5) pkix(7) id-mod(0) id-mod-ocsp-02(48) }

   AlgorithmIdentifier{}, SMIMECapability{}, SIGNATURE-ALGORITHM,
   PUBLIC-KEY
     FROM AlgorithmInformation-2009 -- From [RFC5912]
       { iso(1) identified-organization(3) dod(6) internet(1)
         security(5) mechanisms(5) pkix(7) id-mod(0)
         id-mod-algorithmInformation-02(58) }

   EXTENSION
     FROM PKIX-CommonTypes-2009 -- From [RFC5912]
      { iso(1) identified-organization(3) dod(6) internet(1) security(5)
        mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)} ;

    --  Add re-preferred-signature-algorithms to the set of extensions
    --  for TBSRequest.requestExtensions

   re-preferred-signature-algorithms EXTENSION ::= {
      SYNTAX PreferredSignatureAlgorithms
      IDENTIFIED BY id-pkix-ocsp-pref-sig-algs  }

   id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }

   PreferredSignatureAlgorithms ::= SEQUENCE OF
                                      PreferredSignatureAlgorithm

   PreferredSignatureAlgorithm ::= SEQUENCE {
    sigIdentifier       AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}},
    pubKeyAlgIdentifier SMIMECapability{PUBLIC-KEY, {...}} OPTIONAL  }

 END

A.2. 1988 ASN.1 Module

 OCSP-AGILITY-88 { iso(1) identified-organization(3) dod(6) internet(1)
     security(5) mechanisms(5) pkix(7) id-mod(0)
     id-mod-ocsp-agility-2009-88(67) }

 DEFINITIONS EXPLICIT TAGS ::=
 BEGIN

   -- EXPORTS ALL;
   IMPORTS

   id-pkix-ocsp  -- From [RFC2560]
     FROM OCSP
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-ocsp(14)}

   AlgorithmIdentifier
     FROM PKIX1Explicit88 -- From [RFC5280]
      { iso(1) identified-organization(3) dod(6) internet(1) security(5)
        mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) };

   SMIMECapability
     FROM SecureMimeMessageV3dot1 -- From [RFC5751]
      { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
        smime(16) modules(0) msg-v3dot1(21) }

     id-pkix-ocsp-pref-sig-algs OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }

     PreferredSignatureAlgorithms ::= SEQUENCE OF
                                      PreferredSignatureAlgorithm

     PreferredSignatureAlgorithm ::= SEQUENCE {
        sigIdentifier        AlgorithmIdentifier,
        pubKeyAlgIdentifier  SMIMECapability OPTIONAL
        }

 END

Authors' Addresses 💌

Stefan Santesson
3xA Security AB
Sweden

Email: sts@aaa-sec.com


Phillip Hallam-Baker
Default Deny Security

EMail: hallam@gmail.com

📦 where this page comes from

ietf: rfc6277 2011-06
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms