Online Certificate Status Protocol (OCSP) Support for Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)
Extracted elements (16)
OCSP responses are well-bounded and small in size, making them preferable to large Certificate Revocation Lists (CRLs) for constrained clients and networks. This mechanism allows PKINIT clients and the KDC to maximize reuse of cached OCSP responses.
OCSP responses transmitted via this mechanism are signed by the OCSP server, which must be trusted by the receiver. Depending on local policy, further verification of the validity of the OCSP servers themselves may be needed.
Absence of an expected OCSP response from the KDC for the KDC's certificates SHOULD be treated as an error by the client, unless it is configured otherwise. There is no integrity protection for empty or missing OCSP responses.
If a PKINIT client or KDC cannot validate certificates without a valid PA-PK-OCSP-RESPONSE, then it SHOULD fail the AS exchange, possibly according to local configuration.
If more than one OcspResponse is included in PKOcspData, the first OcspResponse MUST contain the OCSP response for the signer's certificate (client for AS-REQ, KDC for AS-REP).
The client and/or the KDC MAY ignore a valid OCSP response and perform its own revocation status verification independently.
The client and the KDC SHOULD ignore invalid OCSP responses received via this mechanism, and MAY implement CRL processing logic as a fall-back if the OCSP responses alone are not sufficient for certificate validity verification.
The client MAY send OCSP responses for certificates used in PA-PK-AS-REQ via a PA-PK-OCSP-RESPONSE pre-authentication element.
The KDC MAY send a PA-PK-OCSP-RESPONSE even when it does not receive one from the client, proactively providing OCSP data for its own certificates.
The KDC that receives a PA-PK-OCSP-RESPONSE SHOULD send a PA-PK-OCSP-RESPONSE containing OCSP responses for certificates used in the KDC's PA-PK-AS-REP. The client can solicit this by sending a PKOcspData containing an empty sequence.
A new Kerberos pre-authentication type PA-PK-OCSP-RESPONSE (value 18) is defined to carry OCSP responses in-band during PKINIT authentication exchanges. Both clients and the KDC may include this padata in AS-REQ and AS-REP messages respectively.
A Kerberos pre-authentication type identifier PA-PK-OCSP-RESPONSE with value 18 is defined for this mechanism.
Denial-of-service attacks via manipulation of PA-PK-OCSP-RESPONSE are considered acceptable because Kerberos V does not protect against denial-of-service attacks in general; the worst outcome is that a client or KDC must fall back to downloading large CRLs.
The PA-PK-OCSP-RESPONSE pre-authentication data does not authenticate any principals; it is designed solely to be used in conjunction with PKINIT and is not a standalone authentication mechanism.
There is no binding between PA-PK-OCSP-RESPONSE pre-authentication data and PKINIT pre-authentication data other than an OCSP response corresponding to a certificate used in a PKINIT element. Attacks involving removal or replacement of PA-PK-OCSP-RESPONSE elements are at worst downgrade attacks (causing operation without OCSP/CRL validation) or denial-of-service attacks.
The padata-value for PA-PK-OCSP-RESPONSE is the DER encoding of PKOcspData, defined as SEQUENCE OF OcspResponse, where each OcspResponse is an OCTET STRING containing a complete OCSP response as defined in RFC 2560.