Online Certificate Status Protocol (OCSP) Nonce Extension
obsoletes
- rfc-8954 — Online Certificate Status Protocol (OCSP) Nonce Extension
updates
- rfc-6960 — X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Extracted elements (15)
The 1998 ASN.1 module (Appendix A.1) remains the normative module per the policy of the PKIX Working Group, even though a 2008 ASN.1 module is also provided (Appendix A.2).
The maximum Nonce length was extended from 32 octets (RFC 8954) to 128 octets to support cryptographic algorithms that generate nonces longer than 32 octets. The minimum of 1 octet is retained for backward compatibility with older OCSP requesters following RFC 6960.
Implementations compliant with RFC 8954 will not be able to process nonces generated per the new specification with sizes in excess of the 32-octet limit specified in RFC 8954. Deployers must account for this backward-compatibility constraint.
An OCSP requester that implements the extension in this document MUST use a minimum length of 32 octets for Nonce in the Nonce extension.
An OCSP responder that supports the Nonce extension MUST accept Nonce lengths of at least 16 octets and up to and including 32 octets. A responder MAY choose to respond without the Nonce extension for requests where the Nonce length is between 1–15 octets or 33–128 octets.
If the Nonce extension is present, the length of the Nonce MUST be at least 1 octet and can be up to 128 octets.
Responders that implement this extension MUST reject any OCSP request that has a Nonce with a length of either 0 octets or greater than 128 octets, with the malformedRequest OCSPResponseStatus as described in Section 4.2.1 of RFC 6960.
The value of the Nonce MUST be generated using a cryptographically strong pseudorandom number generator (see RFC 4086).
The Nonce cryptographically binds an OCSP request and response to prevent replay attacks. It is included as a requestExtension in requests and as a responseExtension in responses, identified by the OID id-pkix-ocsp-nonce (1.3.6.1.5.5.7.48.1.2).
The OCSPResponseStatus enumeration defines six values: successful (0), malformedRequest (1), internalError (2), tryLater (3), sigRequired (5), and unauthorized (6); value 4 is not used. A malformedRequest status MUST be returned when the Nonce length is 0 or greater than 128 octets.
IANA assigned two OIDs in the 'SMI Security for PKIX Module Identifier' registry (1.3.6.1.5.5.7.0): value 111 for id-mod-ocsp-2024-88 (1998 ASN.1 module) and value 112 for id-mod-ocsp-2024-08 (2008 ASN.1 module).
During the interval in which a previous OCSP response for a certificate is not yet expired but the responder has a changed status for that certificate, a copy of the old response can be replayed to indicate the certificate is still valid. Including a requester's nonce value in the OCSP response ensures the response is the most recent one from the server.
Since the OCSP responder may choose not to send the Nonce extension in the response even if the requester sent it (per RFC 5019), an on-path attacker can intercept the request and respond with an earlier response without the Nonce. This can be mitigated by configuring a short interval between thisUpdate and nextUpdate in the OCSP response.
An example encoded OCSP Nonce extension with a 32-octet Nonce is provided: a SEQUENCE containing the OID id-pkix-ocsp-nonce (9 bytes) and an OCTET STRING encapsulating a 32-byte OCTET STRING value, totaling 47 bytes.
The Nonce field is encoded as an OCTET STRING with a size constraint of 1 to 128 octets: `Nonce ::= OCTET STRING(SIZE(1..128))`. The extnValue of the Nonce extension contains the DER-encoded Nonce value encapsulated in an OCTET STRING wrapper.