Re: [TLS] Last Call: draft-ietf-tls-rfc4366-bis (Transport Layer Security (TLS) Extensions: Extension Definitions) to Proposed Standard

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [TLS] Last Call: draft-ietf-tls-rfc4366-bis (Transport Layer Security (TLS) Extensions: Extension Definitions) to Proposed Standard

From: Eric Rescorla <ekr at networkresonance.com>
To: Dean Anderson <dean at av8.com>
Cc: Simon Josefsson <simon at josefsson.org>, ietf at ietf.org, tls at ietf.org
Date: Wed, 23 Sep 2009 12:08:30 -0700
In-reply-to: <Pine.LNX.4.44.0909231500110.8840-100000 at citation2.av8.net>
References: <87ab0lskpf.fsf at mocca.josefsson.org> <Pine.LNX.4.44.0909231500110.8840-100000 at citation2.av8.net>

At Wed, 23 Sep 2009 15:04:00 -0400 (EDT),
Dean Anderson wrote:
> 
> Is that insecure?
> 
> If the client is authorized by certificate, then it seems that it has 
> that identity in addition to any application level identities.
> 
> The only insecurity is if the certifiate private key has been
> compromised, which isn't something that TLS can protect against.
> 
> One problem with using TLS for virtual web hosts is that the server
> names cannot match the single name allowed in the certificate.  I don't
> want to see that get worse; I'd like to see it get better.

The server_name extension [RFC 4366] allows this.

-Ekr

References:
- Re: Last Call: draft-ietf-tls-rfc4366-bis (Transport Layer Security (TLS) Extensions: Extension Definitions) to Proposed Standard
  - From: Simon Josefsson

Prev by Date: Re: Request for community guidance on issue concerning a future meeting of the IETF
Next by Date: Re: Request for community guidance on issue concerning a future meeting of the IETF
Previous by thread: Re: Last Call: draft-ietf-tls-rfc4366-bis (Transport Layer Security (TLS) Extensions: Extension Definitions) to Proposed Standard
Next by thread: RE: [TLS] Last Call: draft-ietf-tls-rfc4366-bis (Transport Layer Security (TLS) Extensions: Extension Definitions) to Proposed Standard
Index(es):
- Date
- Thread

Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.

Re: [TLS] Last Call: draft-ietf-tls-rfc4366-bis (Transport Layer Security (TLS) Extensions: Extension Definitions) to Proposed Standard

Note: Messages sent to this list are the opinions of the senders and do not imply endorsement by the IETF.