{"action":"created","issue":{"url":"https://api.github.com/repos/hbldh/pybankid/issues/5","labels_url":"https://api.github.com/repos/hbldh/pybankid/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/hbldh/pybankid/issues/5/comments","events_url":"https://api.github.com/repos/hbldh/pybankid/issues/5/events","html_url":"https://github.com/hbldh/pybankid/issues/5","id":99659277,"number":5,"title":"Investigate Verification of OCSP Response/Signature ","user":{"login":"Tethik","id":298627,"avatar_url":"https://avatars.githubusercontent.com/u/298627?v=3","gravatar_id":"","url":"https://api.github.com/users/Tethik","html_url":"https://github.com/Tethik","followers_url":"https://api.github.com/users/Tethik/followers","following_url":"https://api.github.com/users/Tethik/following{/other_user}","gists_url":"https://api.github.com/users/Tethik/gists{/gist_id}","starred_url":"https://api.github.com/users/Tethik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tethik/subscriptions","organizations_url":"https://api.github.com/users/Tethik/orgs","repos_url":"https://api.github.com/users/Tethik/repos","events_url":"https://api.github.com/users/Tethik/events{/privacy}","received_events_url":"https://api.github.com/users/Tethik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-08-07T14:33:58Z","updated_at":"2015-08-13T13:45:59Z","closed_at":null,"body":"See page 27 of docs:\r\nhttps://www.bankid.com/assets/bankid/rp/riktlinjer-foer-mobilt-bankid-till-foerlitande-part-1-0-7.pdf\r\n\r\nThe docs don't explain it that well, but the collect response contains a signature from the client, and a OCSP response by what I'm guessing is the bank which signed the client's certificate. \r\n\r\n> The OCSP 0 response is signed by a certificate that has the same issuer as the certificate being \r\n> verified (i.e. the BankId).\r\n\r\nI think the purpose for this is that it gives the bank power to revoke the user certificate. So the infrastructure in that sense is reliant on both the bank and the BankID backend. I think the bank controls the OCSP stapling, while BankID stands for the authentication infrastructure. \r\n\r\nI found some old documentation of the server architecture for the Norwegian system from 2005:\r\nhttp://www.eurim.org.uk/activities/pi/BankIDWhitePaper.pdf\r\n\r\nSo there seems to be the root-CA which is jointly owned by all the banks. Then each bank gets its own level-1 CA signed by the root. \r\n\r\nQuestion is, do we need to verify these as a merchant? Why would they include them in the response otherwise? \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/hbldh/pybankid/issues/comments/130677344","html_url":"https://github.com/hbldh/pybankid/issues/5#issuecomment-130677344","issue_url":"https://api.github.com/repos/hbldh/pybankid/issues/5","id":130677344,"user":{"login":"Tethik","id":298627,"avatar_url":"https://avatars.githubusercontent.com/u/298627?v=3","gravatar_id":"","url":"https://api.github.com/users/Tethik","html_url":"https://github.com/Tethik","followers_url":"https://api.github.com/users/Tethik/followers","following_url":"https://api.github.com/users/Tethik/following{/other_user}","gists_url":"https://api.github.com/users/Tethik/gists{/gist_id}","starred_url":"https://api.github.com/users/Tethik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tethik/subscriptions","organizations_url":"https://api.github.com/users/Tethik/orgs","repos_url":"https://api.github.com/users/Tethik/repos","events_url":"https://api.github.com/users/Tethik/events{/privacy}","received_events_url":"https://api.github.com/users/Tethik/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T13:45:59Z","updated_at":"2015-08-13T13:45:59Z","body":"To clarify, **userNonVisibileData** is sent to the Sign method at the API."}}