Re: [TLS] the use cases for GSS-based TLS and the plea for integrating

[Martin Rex <Martin.Rex at sap.com>]

Yoav Nir wrote:
> 
> I disagree with that characterization of certificate-based  
> authentication.
> 
> You may not need to communicate with an identity provider, but you do  
> need to validate the certificate. This necessarily implies checking  
> for revocation. Now this could be done using CRL fetching, or OCSP or  
> SCVP, but it usually means external communications.

Nope, certificate validation does NOT imply certificate revocation
checking.  A CA may want to assert policies to do so, but that
is an entirely different can of worms.

A software architecture that performs certificate revoction checks
by synchronously communicating with third parties over the network
is likely to cause serious problem for the performance and
availability of a service.

I certainly don't mean to imply that certification checking is entirely
useless.  But my idea about a reasonable implementation of
certificate revocation checking precludes synchronous communication
with third parties, and therefore (accessing an) OCSP(-server).
But even then, I would NOT do this within the TLS handshake itself.


-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls