X.509v3 Transport Layer Security (TLS) Feature Extension
X.509v3 Transport Layer Security (TLS) Feature Extension
复制标题
DOI：
10.17487/rfc7633
复制
发表时间：
2015-10
期刊：
影响因子：
--
通讯作者：
P. Hallam-Baker
中科院分区：
文献类型：
--
作者：
P. Hallam-Baker
TLS功能扩展的目的是防止TLS协议无法防止的降级攻击。具体地，TLS特征扩展可以用于强制支持TLS协议中的撤销检查特征，诸如在线证书状态协议（OCSP）装订。通知客户端OCSP状态响应将始终被装订，允许在响应未被装订的情况下立即失败。这反过来又防止了可能发生的拒绝服务攻击。
The purpose of the TLS feature extension is to prevent downgrade attacks that are not otherwise prevented by the TLS protocol. In particular, the TLS feature extension may be used to mandate support for revocation checking features in the TLS protocol such as Online Certificate Status Protocol (OCSP) stapling. Informing clients that an OCSP status response will always be stapled permits an immediate failure in the case that the response is not stapled. This in turn prevents a denial-of-service attack that might otherwise be possible.