RFC 8954

Online Certificate Status Protocol (OCSP) Nonce Extension

📅 published November 2020, from ietf

Online Certificate Status Protocol (OCSP) Nonce Extension ✨

Okay bestie, check this out 💜 This is RFC 8954, a Standards Track doc by M. Sahni, Ed. of Palo Alto Networks, published November 2020. It updates RFC 6960 (it doesn't obsolete anything 👀). The ISSN is 2070-1721, and it's the IETF's official word on the OCSP Nonce extension. Lowkey iconic. 🎀

The whole point is that OCSP is how you check whether a certificate is still good, and the Nonce extension is what cryptographically ties a response to the exact request that asked for it 🔐. This doc gives the nonce a proper length range, because RFC 6960 didn't say anything about min or max length and that's a whole vulnerability vibe 😭.

Status of This Memo 📜

This is an Internet Standards Track document 🦋.

It's a product of the Internet Engineering Task Force (IETF) and has consensus from the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 7841 💅.

You can find the current status, errata, and how to give feedback at https://www.rfc-editor.org/info/rfc8954 🌸.

Copyright Notice 💖

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as of the publication date. Read those carefully because they spell out your rights and restrictions 🙈. Code Components pulled from this document have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in that license 🫶.

Table of Contents 🗺️

1.  Introduction
  1.1.  Terminology
2.  OCSP Extensions
  2.1.  Nonce Extension
3.  Security Considerations
  3.1.  Replay Attack
  3.2.  Nonce Collision
4.  IANA Considerations
5.  Changes to Appendix B of RFC 6960
  5.1.  Changes to Appendix B.1 OCSP in ASN.1 - 1998 Syntax
  5.2.  Changes to Appendix B.2 OCSP in ASN.1 - 2008 Syntax
6.  References
  6.1.  Normative References
  6.2.  Informative References
Author's Address

1. Introduction 🌷

Okay so the big thing here is this doc updates how the Nonce extension gets used and formatted in OCSP requests and responses 💅. The Nonce extension was originally defined in Section 4.4.1 of [RFC6960] 📖. The catch? [RFC6960] never says how short or long a nonce can be 😭. That means OCSP responders following [RFC6960] could be open to stuff like Denial-of-Service attacks [RFC4732] or chosen-prefix attacks (to get a signature they want), plus sketchy evasions using the Nonce extension data 💀.

So this doc sets a lower limit of 1 and an upper limit of 32 for the nonce length 🎀. It updates [RFC6960] 💜.

1.1. Terminology 🔤

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are to be read as described in BCP 14 [RFC2119] [RFC8174] only when they show up in all capitals, just like here 🧚.

2. OCSP Extensions 🦋

The message formats for OCSP requests and responses are defined in [RFC6960] ✨. [RFC6960] also defines the standard extensions for OCSP messages, based on the extension model used in X.509 version 3 certificates (see [RFC5280]) 🌈. This doc only specifies the new format for the Nonce extension and doesn't change any of the other standard extensions in [RFC6960] 💅.

2.1. Nonce Extension 🔐

This section replaces the entirety of Section 4.4.1 of [RFC6960], which describes the OCSP Nonce extension 🫶.

The nonce is what cryptographically binds a request and a response to stop replay attacks 🔁. It goes in requestExtensions for requests, and in responseExtensions for responses 💖. In both places, the nonce is identified by the object identifier id-pkix-ocsp-nonce, and the extnValue is the nonce's value ✨. If the Nonce extension is present, the length of the nonce MUST be at least 1 octet and can be up to 32 octets 👑.

A server MUST reject any OCSP request that has a nonce in the Nonce extension with a length of either 0 octets or more than 32 octets, using the malformedRequest OCSPResponseStatus, as described in Section 4.2.1 of [RFC6960] 🙅‍♀️.

The nonce value MUST be generated with a cryptographically strong pseudorandom number generator (see [RFC4086]) 🎲. The minimum nonce length of 1 octet exists so that older clients following [RFC6960] still work 🥺. Newer OCSP clients that support this doc MUST use a length of 32 octets for the nonce in the Nonce extension 💪. OCSP responders MUST accept lengths of at least 16 octets, and MAY choose to ignore the Nonce extension for requests where the nonce is less than 16 octets 🌸.

   id-pkix-ocsp           OBJECT IDENTIFIER ::= { id-ad-ocsp }
   id-pkix-ocsp-nonce     OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }

   Nonce ::= OCTET STRING(SIZE(1..32))

3. Security Considerations 🛡️

Okay this section is SERIOUS, bestie 😭🚨

The general security considerations for OCSP are described in [RFC6960] 📖. During the interval when the previous OCSP response for a certificate hasn't expired but the responder's status for that certificate has changed, a copy of that old response can be used to claim the certificate is still valid 💀. Including a client's nonce in the OCSP response makes sure the response is the latest one from the server and not an old copy 🙌.

3.1. Replay Attack 🔁

The Nonce extension exists to avoid replay attacks 🛑. The OCSP responder may choose not to send the Nonce extension in the response even when the client sent one in the request [RFC5019]. That means an on-path attacker can intercept the OCSP request and reply with an earlier response from the server that has no Nonce extension 😱. This can be mitigated by configuring the server to use a short time interval between the thisUpdate and nextUpdate fields in the OCSP response 🎯.

3.2. Nonce Collision 💥

If the nonce a client uses in the OCSP request is predictable, an attacker can prefetch responses with the predicted nonce and replay them, which totally defeats the purpose of the nonce 😤. So the value of the Nonce extension in the OCSP request MUST contain cryptographically strong randomness and MUST be freshly generated when the OCSP request is created 🔐. Also, if the nonce is too short (e.g., 1 octet), an on-path attacker can prefetch responses for every possible nonce value and replay a matching one 🥴.

4. IANA Considerations 📋

This document has no IANA actions 🌈.

5. Changes to Appendix B of RFC 6960 📝

This section updates the ASN.1 definitions of the OCSP Nonce extension in Appendices B.1 and B.2 of [RFC6960] ✨. Appendix B.1 defines OCSP using ASN.1 - 1998 Syntax, and Appendix B.2 defines OCSP using ASN.1 - 2008 Syntax 🦋.

5.1. Changes to Appendix B.1 OCSP in ASN.1 - 1998 Syntax 🧩

OLD Syntax:

The definition of the OCSP Nonce extension is not provided in Appendix B.1 of [RFC6960] for the ASN.1 - 1998 Syntax.

NEW Syntax:

   Nonce ::= OCTET STRING(SIZE(1..32))

5.2. Changes to Appendix B.2 OCSP in ASN.1 - 2008 Syntax 🧩

OLD Syntax:

   re-ocsp-nonce EXTENSION ::= { SYNTAX OCTET STRING IDENTIFIED
       BY id-pkix-ocsp-nonce }

NEW Syntax:

   re-ocsp-nonce EXTENSION ::= { SYNTAX OCTET STRING(SIZE(1..32))
       IDENTIFIED BY id-pkix-ocsp-nonce }

6. References 📚

6.1. Normative References 💜

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
           Housley, R., and W. Polk, "Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
           <https://www.rfc-editor.org/info/rfc5280>.

[RFC6960]  Santesson, S., Myers, M., Ankney, R., Malpani, A.,
           Galperin, S., and C. Adams, "X.509 Internet Public Key
           Infrastructure Online Certificate Status Protocol - OCSP",
           RFC 6960, DOI 10.17487/RFC6960, June 2013,
           <https://www.rfc-editor.org/info/rfc6960>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

6.2. Informative References 🌸

[RFC4086]  Eastlake 3rd, D., Schiller, J., and S. Crocker,
           "Randomness Requirements for Security", BCP 106, RFC 4086,
           DOI 10.17487/RFC4086, June 2005,
           <https://www.rfc-editor.org/info/rfc4086>.

[RFC4732]  Handley, M., Ed., Rescorla, E., Ed., and IAB, "Internet
           Denial-of-Service Considerations", RFC 4732,
           DOI 10.17487/RFC4732, December 2006,
           <https://www.rfc-editor.org/info/rfc4732>.

[RFC5019]  Deacon, A. and R. Hurst, "The Lightweight Online
           Certificate Status Protocol (OCSP) Profile for High-Volume
           Environments", RFC 5019, DOI 10.17487/RFC5019, September
           2007, <https://www.rfc-editor.org/info/rfc5019>.

Author's Address 💌

Mohit Sahni (editor) Palo Alto Networks 3000 Tannery Way Santa Clara, CA 95054 United States of America

Email: msahni@paloaltonetworks.com

That's the whole doc, bestie 🌈💖 Go be a main character in your OCSP responder config 👑✨

📦 where this page comes from

ietf: rfc8954 2020-11
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms