Repository navigation
OCSP: use 32-byte nonces by default (RFC 9654) #33181
Description
Activity
I think
openssl ocspshould request 32 bytes when acting as a client and reject invalid nonce lengths when acting as a responder. RFC 8954 already asked clients implementing its nonce rules to send exactly 32 bytes. The command still gets a nonce of 16 bytes from the library default, so it can request 32 explicitly. RFC 9654 requires a responder that supports the nonce extension to reject anything over 128 bytes. A nonce with no bytes must be rejected too. I don't see a practical weakness in the current 16 bytes of random data.On your question, I would put the request check in
make_ocsp_response, before response signing.OCSP_copy_nonceis a public copying API, and the app currently ignores its return value. If the copy started rejecting input, the app could still sendsuccessfulafter silently leaving out the nonce. The app should validate the request itself, then treat a failure to copy asinternalError. The check also needs to run when a responder chooses not to echo a valid nonce.I wouldn't change
OCSP_DEFAULT_NONCE_LENGTH.OCSP_request_add1_nonceandOCSP_basic_add1_nonceuse it whenlenis zero or negative, even if the caller supplies the nonce bytes. An application built with today headers can allocateunsigned char nonce[OCSP_DEFAULT_NONCE_LENGTH]and pass that buffer withlenset to zero. If libcrypto raises the default to 32, it will read 32 bytes from a buffer of 16. That's a breaking change for existing callers. Library users who want a nonce of 32 bytes can request that length explicitly.Please go ahead with the PR.
RFC 9654 says OCSP requesters MUST use a nonce of at least 32 octets, and responders MUST reject a nonce of 0 or more than 128 octets with malformedRequest.
OpenSSL defaults to 16 (
OCSP_DEFAULT_NONCE_LENGTH), whichopenssl ocspandOCSP_request_add1_nonce(req, NULL, 0)use. On the responder side,OCSP_copy_nonce()copies any length.I'd propose raising the default to 32 and making the
openssl ocspresponder reject 0 or >128 octet nonces. Should the length check go in the app only, or inOCSP_copy_nonce()? Happy to send a PR.