Online Certificate Status Protocol (OCSP) Nonce Extension
obsoleted by
- rfc-9654 — Online Certificate Status Protocol (OCSP) Nonce Extension
updates
- rfc-6960 — X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Extracted elements (14)
RFC 6960 did not specify minimum or maximum nonce lengths, leaving OCSP responders vulnerable to Denial-of-Service attacks, chosen-prefix attacks, and possible evasions. This document introduces a 1-to-32 octet range to address these vulnerabilities.
The minimum nonce length of 1 octet is defined to provide backward compatibility with older OCSP clients that follow RFC 6960, which specified no minimum or maximum nonce length.
OCSP responders MAY ignore the Nonce extension for requests where the nonce length is less than 16 octets, providing a transition path while still accepting the minimum 1-octet nonces required for backward compatibility with RFC 6960 clients.
A server MUST reject any OCSP request with a nonce of either 0 octets or more than 32 octets with the malformedRequest OCSPResponseStatus.
If the Nonce extension is present, the length of the nonce MUST be at least 1 octet and can be up to 32 octets.
Newer OCSP clients that support this document MUST use a length of 32 octets for the nonce in the Nonce extension.
OCSP responders MUST accept nonce lengths of at least 16 octets and MAY choose to ignore the Nonce extension for requests where the nonce length is less than 16 octets.
The nonce value in the OCSP request MUST contain cryptographically strong randomness and MUST be freshly generated at the time of creation of the OCSP request.
The value of the nonce MUST be generated using a cryptographically strong pseudorandom number generator (RFC 4086).
The Nonce extension cryptographically binds an OCSP request to a response to prevent replay attacks. It is included as a requestExtension in requests and as a responseExtension in responses, identified by id-pkix-ocsp-nonce.
An on-path attacker can intercept an OCSP request and respond with an earlier response lacking the Nonce extension, since responders may omit the Nonce even when clients include it. This can be mitigated by configuring short thisUpdate-to-nextUpdate intervals.
If the nonce value is predictable, an attacker may prefetch responses with the predicted nonce and replay them. If the nonce is too small (e.g., 1 octet), an attacker can prefetch responses for all possible nonce values.
The Nonce extension value is an OCTET STRING constrained to SIZE(1..32), identified by OID id-pkix-ocsp-nonce { id-pkix-ocsp 2 }. It appears in requestExtensions in requests and responseExtensions in responses.
Updated ASN.1 1998 syntax defines Nonce as OCTET STRING(SIZE(1..32)). Updated ASN.1 2008 syntax changes re-ocsp-nonce EXTENSION to use SYNTAX OCTET STRING(SIZE(1..32)) IDENTIFIED BY id-pkix-ocsp-nonce.