5 ms·
This problem has already been solved: http://en.wikipedia.org/wiki/OCSP_stapling http://en.wikipedia.org/wiki/OCSP_stapling Yes, there are problems with OCSP s
by gst 15y ago
This problem has already been solved: http://en.wikipedia.org/wiki/OCSP_stapling http://en.wikipedia.org/wiki/OCSP_stapling
Yes, there are problems with OCSP stapling, but it is much better then what's currently used. In addition, it does not depend on a central authority as in the approach proposed by Google.
- marshray 15y agoThere are two problems with OCSP stapling: * It requires some configuration on the server side. So it probably won't be enabled for the great majority of sites until some future generation of upgrades enables it by default. * If a MitM presents his evil server to the client, he's just going to opt out of sending the stapled OCSP response. So the browser's back in exactly the same situation where he has to block for 1 whole extra second to do traditional OCSP (and has the same hard decision to make about what to tell the user if it fails). EDIT: Which is not to say that I don't think it's still a great idea. It just would have worked a lot better if it had been the original OCSP mechanism.
- obtu 15y agoOCSP stapling is good for privacy and latency, but it requires every server to upgrade to provide any increased security. Until then it is as insecure as OCSP: it can just be stripped.