3 ms·
It doesn't really impact the MiTM attacks described in the article. An attacker who is able to sit in the middle with their own trusted cert is simply going to
by JshWright 13y ago
It doesn't really impact the MiTM attacks described in the article.
An attacker who is able to sit in the middle with their own trusted cert is simply going to not bother passing the stapled OCSP response along. The victims browser will do an OCSP lookup (or not...) for the trusted cert the attacker provided, and that will succeed.
I'm not sure how OCSP caching is implemented in the browsers that implement OCSP in the first place (is there a spec for caching?), but as it's a method for checking the revocation status of certs, it can't be cached long.
- ck2 13y agoI am not sure what it uses to validate but I have a ocsp stapling file I made openssl test reports OCSP Response Status: successful (0x0) Cert Status: good This Update: Sep 8 xx:xx:xx 2013 GMT Next Update: Sep 10 xx:xx:xx 2013 GMT Validity Not Before: Aug 22 xx:xx:xx 2013 GMT Not After : Oct 2 xx:xx:xx 2013 GMT So that's quite a long cache. I thought it would fail after the 10th but apparently it is using the CA valid date range?