The Experts below are selected from a list of 879 Experts worldwide ranked by ideXlab platform

Vitaly Shmatikov - One of the best experts on this subject based on the ideXlab platform.

  • using frankencerts for automated adversarial testing of Certificate Validation in ssl tls implementations
    IEEE Symposium on Security and Privacy, 2014
    Co-Authors: Chad Brubaker, Suman Jana, Sarfraz Khurshid, Vitaly Shmatikov
    Abstract:

    Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 Certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of Certificate Validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic Certificates that are randomly mutated from parts of real Certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a Certificate while another rejects the same Certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version1 Certificate can act as a rogue Certificate authority and issue fake Certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept Certificate authorities created by unauthorized issuers, as well as Certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about Certificate Validation errors. When presented with an expired, self-signed Certificate, NSS, Safari, and Chrome (on Linux) report that the Certificate has expired - a low-risk, often ignored error - but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencerts is a powerful methodology for discovering security flaws in SSL/TLS implementations.

  • IEEE Symposium on Security and Privacy - Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations
    IEEE security & privacy, 2014
    Co-Authors: Chad Brubaker, Suman Jana, Sarfraz Khurshid, Vitaly Shmatikov
    Abstract:

    Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 Certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of Certificate Validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic Certificates that are randomly mutated from parts of real Certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a Certificate while another rejects the same Certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version1 Certificate can act as a rogue Certificate authority and issue fake Certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept Certificate authorities created by unauthorized issuers, as well as Certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about Certificate Validation errors. When presented with an expired, self-signed Certificate, NSS, Safari, and Chrome (on Linux) report that the Certificate has expired - a low-risk, often ignored error - but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencerts is a powerful methodology for discovering security flaws in SSL/TLS implementations.

  • Using frankencerts for automated adversarial testing of Certificate Validation in SSL/TLS implementations
    Proceedings - IEEE Symposium on Security and Privacy, 2014
    Co-Authors: Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid, Vitaly Shmatikov
    Abstract:

    Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 Certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of Certificate Validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic Certificates that are randomly mutated from parts of real Certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a Certificate while another rejects the same Certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version1 Certificate can act as a rogue Certificate authority and issue fake Certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept Certificate authorities created by unauthorized issuers, as well as Certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about Certificate Validation errors. When presented with an expired, self-signed Certificate, NSS, Safari, and Chrome (on Linux) report that the Certificate has expired - a low-risk, often ignored error - but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencert- is a powerful methodology for discovering security flaws in SSL/TLS implementations.

Shigen Shen - One of the best experts on this subject based on the ideXlab platform.

  • ISECS - Unified Certificate Validation System DNS-OCSP
    2008 International Symposium on Electronic Commerce and Security, 2008
    Co-Authors: Shigen Shen
    Abstract:

    To solve the interoperable problem during current Certificate Validation process of different Certificate authorities (CAs), the new system DNS-OCSP is proposed by incorporating DNS-style referral, which can construct a unified Certificate Validation mechanism between different CAs. The architecture of DNS-OCSP is presented, and the workflow of DNS-OCSP is illuminated. It has been shown that the DNS-OCSP is more accessible and scalable.

  • Unified Certificate Validation system DNS-OCSP
    Proceedings of the International Symposium on Electronic Commerce and Security ISECS 2008, 2008
    Co-Authors: Shigen Shen, Guangxue Yue
    Abstract:

    To solve the interoperable problem during current Certificate Validation process of different Certificate authorities (CAs), the new system DNS-OCSP is proposed by incorporating DNS-style referral, which can construct a unified Certificate Validation mechanism between different CAs. The architecture of DNS-OCSP is presented, and the workflow of DNS-OCSP is illuminated. It has been shown that the DNS-OCSP is more accessible and scalable. View full abstract

  • Unified Certificate Validation System DNS-OCSP
    2008 International Symposium on Electronic Commerce and Security, 2008
    Co-Authors: Shigen Shen
    Abstract:

    To solve the interoperable problem during current Certificate Validation process of different Certificate authorities (CAs), the new system DNS-OCSP is proposed by incorporating DNS-style referral, which can construct a unified Certificate Validation mechanism between different CAs. The architecture of DNS-OCSP is presented, and the workflow of DNS-OCSP is illuminated. It has been shown that the DNS-OCSP is more accessible and scalable.

Liang Zhao - One of the best experts on this subject based on the ideXlab platform.

  • differential testing of Certificate Validation in ssl tls implementations an rfc guided approach
    ACM Transactions on Software Engineering and Methodology, 2019
    Co-Authors: Cong Tian, Chu Chen, Zhenhua Duan, Liang Zhao
    Abstract:

    Certificate Validation in Secure Sockets Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether Certificate Validation in SSL/TLS implementations is correctly implemented. With this motivation, we propose a novel differential testing approach that is based on the standard Request for Comments (RFC). First, rules of Certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e., Certificates, are assembled automatically. Finally, with the assembled Certificates being test cases, Certificate Validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) Certificates of RFCcert are discrepancy-targeted, since they are assembled according to standards instead of genetics; (2) with the obtained Certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations. In addition, by providing seed Certificates for mutation approaches with RFCcert, the ability of mutation approaches in finding distinct discrepancies is significantly enhanced.

  • Differential Testing of Certificate Validation in SSL/TLS Implementations: An RFC-guided Approach
    ACM Transactions on Software Engineering and Methodology, 2019
    Co-Authors: Cong Tian, Chu Chen, Zhenhua Duan, Liang Zhao
    Abstract:

    Certificate Validation in Secure Sockets Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether Certificate Validation in SSL/TLS implementations is correctly implemented. With this motivation, we propose a novel differential testing approach that is based on the standard Request for Comments (RFC). First, rules of Certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e., Certificates, are assembled automatically. Finally, with the assembled Certificates being test cases, Certificate Validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) Certificates of RFCcert are discrepancy-targeted, since they are assembled according to standards instead of genetics; (2) with the obtained Certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations. In addition, by providing seed Certificates for mutation approaches with RFCcert, the ability of mutation approaches in finding distinct discrepancies is significantly enhanced.

  • ICSE - RFC-directed differential testing of Certificate Validation in SSL/TLS implementations
    Proceedings of the 40th International Conference on Software Engineering, 2018
    Co-Authors: Chu Chen, Cong Tian, Zhenhua Duan, Liang Zhao
    Abstract:

    Certificate Validation in Secure Socket Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether Certificate Validation in SSL/TLS is correctly implemented. With this motivation, we propose a novel differential testing approach which is directed by the standard Request For Comments (RFC). First, rules of Certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e. Certificates, are assembled automatically. Finally, with the assembled Certificates being test cases, Certificate Validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) Certificates of RFCcert are discrepancy-targeted since they are assembled according to standards instead of genetics; (2) with the obtained Certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations.

  • rfc directed differential testing of Certificate Validation in ssl tls implementations
    International Conference on Software Engineering, 2018
    Co-Authors: Chu Chen, Cong Tian, Zhenhua Duan, Liang Zhao
    Abstract:

    Certificate Validation in Secure Socket Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether Certificate Validation in SSL/TLS is correctly implemented. With this motivation, we propose a novel differential testing approach which is directed by the standard Request For Comments (RFC). First, rules of Certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e. Certificates, are assembled automatically. Finally, with the assembled Certificates being test cases, Certificate Validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) Certificates of RFCcert are discrepancy-targeted since they are assembled according to standards instead of genetics; (2) with the obtained Certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations.

  • RFC-Directed Differential Testing of Certificate Validation in SSL/TLS Implementations
    2018 IEEE ACM 40th International Conference on Software Engineering (ICSE), 2018
    Co-Authors: Chu Chen, Cong Tian, Zhenhua Duan, Liang Zhao
    Abstract:

    Certificate Validation in Secure Socket Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether Certificate Validation in SSL/TLS is correctly implemented. With this motivation, we propose a novel differential testing approach which is directed by the standard Request For Comments (RFC). First, rules of Certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e. Certificates, are assembled automatically. Finally, with the assembled Certificates being test cases, Certificate Validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) Certificates of RFCcert are discrepancy-targeted since they are assembled according to standards instead of genetics; (2) with the obtained Certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations.

Chad Brubaker - One of the best experts on this subject based on the ideXlab platform.

  • using frankencerts for automated adversarial testing of Certificate Validation in ssl tls implementations
    IEEE Symposium on Security and Privacy, 2014
    Co-Authors: Chad Brubaker, Suman Jana, Sarfraz Khurshid, Vitaly Shmatikov
    Abstract:

    Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 Certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of Certificate Validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic Certificates that are randomly mutated from parts of real Certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a Certificate while another rejects the same Certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version1 Certificate can act as a rogue Certificate authority and issue fake Certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept Certificate authorities created by unauthorized issuers, as well as Certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about Certificate Validation errors. When presented with an expired, self-signed Certificate, NSS, Safari, and Chrome (on Linux) report that the Certificate has expired - a low-risk, often ignored error - but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencerts is a powerful methodology for discovering security flaws in SSL/TLS implementations.

  • IEEE Symposium on Security and Privacy - Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations
    IEEE security & privacy, 2014
    Co-Authors: Chad Brubaker, Suman Jana, Sarfraz Khurshid, Vitaly Shmatikov
    Abstract:

    Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 Certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of Certificate Validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic Certificates that are randomly mutated from parts of real Certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a Certificate while another rejects the same Certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version1 Certificate can act as a rogue Certificate authority and issue fake Certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept Certificate authorities created by unauthorized issuers, as well as Certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about Certificate Validation errors. When presented with an expired, self-signed Certificate, NSS, Safari, and Chrome (on Linux) report that the Certificate has expired - a low-risk, often ignored error - but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencerts is a powerful methodology for discovering security flaws in SSL/TLS implementations.

  • Using frankencerts for automated adversarial testing of Certificate Validation in SSL/TLS implementations
    Proceedings - IEEE Symposium on Security and Privacy, 2014
    Co-Authors: Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid, Vitaly Shmatikov
    Abstract:

    Modern network security rests on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Distributed systems, mobile and desktop applications, embedded devices, and all of secure Web rely on SSL/TLS for protection against network attacks. This protection critically depends on whether SSL/TLS clients correctly validate X.509 Certificates presented by servers during the SSL/TLS handshake protocol. We design, implement, and apply the first methodology for large-scale testing of Certificate Validation logic in SSL/TLS implementations. Our first ingredient is "frankencerts," synthetic Certificates that are randomly mutated from parts of real Certificates and thus include unusual combinations of extensions and constraints. Our second ingredient is differential testing: if one SSL/TLS implementation accepts a Certificate while another rejects the same Certificate, we use the discrepancy as an oracle for finding flaws in individual implementations. Differential testing with frankencerts uncovered 208 discrepancies between popular SSL/TLS implementations such as OpenSSL, NSS, CyaSSL, GnuTLS, PolarSSL, MatrixSSL, etc. Many of them are caused by serious security vulnerabilities. For example, any server with a valid X.509 version1 Certificate can act as a rogue Certificate authority and issue fake Certificates for any domain, enabling man-in-the-middle attacks against MatrixSSL and GnuTLS. Several implementations also accept Certificate authorities created by unauthorized issuers, as well as Certificates not intended for server authentication. We also found serious vulnerabilities in how users are warned about Certificate Validation errors. When presented with an expired, self-signed Certificate, NSS, Safari, and Chrome (on Linux) report that the Certificate has expired - a low-risk, often ignored error - but not that the connection is insecure against a man-in-the-middle attack. These results demonstrate that automated adversarial testing with frankencert- is a powerful methodology for discovering security flaws in SSL/TLS implementations.

Jordi Forne - One of the best experts on this subject based on the ideXlab platform.

  • Using OCSP to secure Certificate-using transactions in M-commerce
    Lecture Notes in Computer Science, 2020
    Co-Authors: Jose L Munoz, Jordi Forne, Oscar Esparza, Bernabe Miguel Soriano
    Abstract:

    The possibility of making the Internet accessible via mobile telephones has generated an important opportunity for electronic commerce. Nevertheless, some deficiencies deter its mass acceptance in e-commerce applications. In order to speed up the information delivery, the use of brokerage systems constitutes an interesting solution. In this paper we review the problem of Certificate Validation in m-commerce transactions and we present an architecture where a broker is used as OCSP responder for the Certificate Validation. A modification over OCSP called H-OCSP is also proposed as a way to reduce the computational load and the bandwidth requirements of OCSP which is specially desirable in the wireless environment. The ASN.1 add-on for H-OCSP that makes it inter-operable with the standard OCSP is defined and the behaviour of H-OCSP compared to standard OCSP is evaluated.

  • Certificate status Validation in mobile ad hoc networks
    IEEE Wireless Communications, 2009
    Co-Authors: Jordi Forne, Jose L Munoz, Oscar Esparza, Francisca Hinarejos
    Abstract:

    Certificate Validation is much more complex in mobile ad hoc networks than in conventional networks because online access to trusted authorities is not always guaranteed. For this reason, we require new solutions to overcome both the lack of infrastructure and the limited capabilities of several user devices. In this article we study the application of different mechanisms for Certificate Validation in MANETs and present a cooperative mechanism for Certificate Validation suitable for MANETs.

  • cervantes a Certificate Validation test bed
    European Public Key Infrastructure Workshop, 2004
    Co-Authors: Jose L Munoz, Jordi Forne, Oscar Esparza, Miguel Soriano
    Abstract:

    Certificate Validation is one of the toughest scalability problems of the PKI. The goal of this paper is to introduce a Java platform for Certificate revocation called CERVANTES. CERVANTES pretends to be an easy to extend tool that allows researchers to develop and test their own “real” revocation systems. As CERVANTES is an open source project it can also be included as part of any open PKI project. The platform is very flexible and due to its modular design it allows for example, to fit a new kind of status checking protocol without having to recompile the source code. CERVANTES includes our implementations of the main standards (CRLs and OCSP) as well as an implementation of a system based on the Merkle Hash Tree (one of the most popular systems among the non-standard ones). Finally, we use CERVANTES to obtain performance results about each developped system. These results guarantee that CERVANTES runs as expected.

  • EuroPKI - CERVANTES - A Certificate Validation test-bed
    Public Key Infrastructure, 2004
    Co-Authors: Jose L Munoz, Jordi Forne, Oscar Esparza, Miguel Soriano
    Abstract:

    Certificate Validation is one of the toughest scalability problems of the PKI. The goal of this paper is to introduce a Java platform for Certificate revocation called CERVANTES. CERVANTES pretends to be an easy to extend tool that allows researchers to develop and test their own “real” revocation systems. As CERVANTES is an open source project it can also be included as part of any open PKI project. The platform is very flexible and due to its modular design it allows for example, to fit a new kind of status checking protocol without having to recompile the source code. CERVANTES includes our implementations of the main standards (CRLs and OCSP) as well as an implementation of a system based on the Merkle Hash Tree (one of the most popular systems among the non-standard ones). Finally, we use CERVANTES to obtain performance results about each developped system. These results guarantee that CERVANTES runs as expected.

  • ACNS - Using OCSP to Secure Certificate-Using Transactions in M-commerce
    Applied Cryptography and Network Security, 2003
    Co-Authors: Jose L Munoz, Jordi Forne, Oscar Esparza, Bernabe Miguel Soriano
    Abstract:

    The possibility of making the Internet accessible via mobile telephones has generated an important opportunity for electronic commerce. Nevertheless, some deficiencies deter its mass acceptance in e-commerce applications. In order to speed up the information delivery, the use of brokerage systems constitutes an interesting solution. In this paper we review the problem of Certificate Validation in m-commerce transactions and we present an architecture where a broker is used as OCSP responder for the Certificate Validation. A modification over OCSP called \(\mathcal{H}\)-OCSP is also proposed as a way to reduce the computational load and the bandwidth requirements of OCSP which is specially desirable in the wireless environment. The ASN.1 add-on for \(\mathcal{H}\)-OCSP that makes it inter-operable with the standard OCSP is defined and the behaviour of \(\mathcal{H}\)-OCSP compared to standard OCSP is evaluated.