OCSP
Click on the red underlined text to get to the source
... trust.
OCSP [RFC2560] offers a useful alternative. The size of an OCSP
response is bounded and small and therefore suitable for in-band ...
... OCSP [RFC2560] offers a useful alternative. The size of an OCSP
response is bounded and small and therefore suitable for in-band
IKEv2 ...
... This document defines an extension to IKEv2 that enables the use of
OCSP for in-band signaling of certificate ...
... payload with "OCSP Content" identifies zero or more trusted
OCSP responders and is a request for inclusion of an OCSP response in
...
... responds with a CERT payload containing the appropriate OCSP
response. This content is recognizable via the same "OCSP Content"
identifier ...
... CERT payload containing the appropriate OCSP
response. This content is recognizable via the same "OCSP Content"
identifier.
...
... payload that contains a new
content encoding, referred to as OCSP Content, that conforms to
the definition and behavior specified in Section 3.1.
...
... the definition and behavior specified in Section 3.1.
OCSP response:
An OCSP response ...
... payload that contains a new
content encoding, referred to as OCSP Content, that conforms to
the definition and behavior specified in Section 3.2.
...
... responder refers to the entity that accepts requests
from an OCSP client and returns responses as defined in [RFC2560].
...
... client and returns responses as defined in [RFC2560].
Note that the OCSP responder does not refer to the party that
sends the CERT ...
... Certificate Encoding Value
-------------------- -----
OCSP Content 14
...
... OCSP Request ...
... hashes in the CERTREQ message is not
needed since the OCSP response is signed by the CA who issued the
certificate ...
... CA who issued the
certificate. In case of (c), the OCSP response is signed by the CA
Designated Responder ...
... CERTREQ message does
not know the public key in advance. The presence of OCSP Content in
a CERTREQ message will identify one or more OCSP ...
... OCSP Content in
a CERTREQ message will identify one or more OCSP responders trusted
by the sender ...
...
3. notifies the recipient of sender's desire to receive OCSP
confirmation in a subsequent CERT payload ...
... OCSP Response ...
... payload carrying a certificate can be achieved by matching the
OCSP response CertID field to the certificate. See [RFC2560] for the
...
... Request for OCSP Support ...
... responder.
Therefore, an OCSP request, as defined in Section 3.1 above, is
transmitted separate from any other CERTREQ payloads ...
... exchange.
Where it is useful to identify more than one trusted OCSP responder,
each such identification SHALL be concatenated in a manner identical
...
...
The Certification Authority value in an OCSP request CERTREQ SHALL be
computed and produced in a manner identical to that of trust anchor ...
... CERTREQ sender SHALL incorporate the
OCSP response into path validation logic defined by [RFC3280].
...
... CERT payload after sending an
OCSP request CERT payload might be an indication that this OCSP ...
... OCSP request CERT payload might be an indication that this OCSP
extension is not supported. As a result, it is recommended that
nodes ...
... all peers do in fact support this extension. Otherwise, it is
recommended that the nodes be configured to try OCSP and, if there is
no response, attempt to determine certificate revocation status ...
... Response to OCSP Support ...
... CERTREQ payload, the recipient SHOULD
acquire the related OCSP-based assertion and produce and transmit an
OCSP response CERT ...
... acquire the related OCSP-based assertion and produce and transmit an
OCSP response CERT payload corresponding to the certificate ...
... IKEv2 exchange.
The means by which an OCSP response may be acquired for production of
an OCSP response CERT ...
... The means by which an OCSP response may be acquired for production of
an OCSP response CERT payload is out of scope of this document.
...
... CERTREQ payload identifying
zero or more OCSP responders trusted by the Responder. In response,
...
... payload carrying its certificate
and an OCSP response CERT payload covering that certificate ...
... Responder returns its certificate and a
separate OCSP response CERT payload covering that certificate ...
... Initiator's certificate and therefore cannot
form an OCSP request as defined in [RFC2560]. To bypass this
...
... problem, hashes are used as defined in Section 4.1. In such
instances, OCSP Requests are simply index values into these data.
Thus, it is easily inferred that OCSP responses ...
... OCSP Requests are simply index values into these data.
Thus, it is easily inferred that OCSP responses can be produced in
the absence of a corresponding request (provided that OCSP nonces ...
... Thus, it is easily inferred that OCSP responses can be produced in
the absence of a corresponding request (provided that OCSP nonces are
not used, see Section 6).
...
...
It is also important in extending IKEv2 toward OCSP in this scenario
that the Initiator has certain knowledge that the Responder ...
... responder signatures.
These factors motivate the definition of OCSP responder hash
extension.
...
...
For the reasons noted above, an OCSP request, as defined in Section
3.1, is used in place of an OCSP request syntax to trigger production
...
... For the reasons noted above, an OCSP request, as defined in Section
3.1, is used in place of an OCSP request syntax to trigger production
and transmission of an OCSP response. OCSP ...
... 3.1, is used in place of an OCSP request syntax to trigger production
and transmission of an OCSP response. OCSP, as defined in [RFC2560],
...
... OCSP request syntax to trigger production
and transmission of an OCSP response. OCSP, as defined in [RFC2560],
may contain a nonce ...
... replay attacks (see Section 4.4.1 of [RFC2560] for further details).
The OCSP request defined by this document cannot accommodate nonces.
[RFC2560 ...
... certificate has been revoked. Deployments of OCSP should carefully
evaluate the benefit of precomputed responses against the probability
of a replay attack ...
... replay attack and the costs associated with its successful
execution." Nodes SHOULD make the required freshness of an OCSP
response configurable.
...
... Encoding field of the Certificate Payload format. Official
assignment of the "OCSP Content" extension to the Cert Encoding table
of Section 3.6 of [IKEv2 ...
... Certificate Encoding Value
-------------------- -----
OCSP Content 14
...
... Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP", RFC 2560prop, June 1999. ...