Re: [TLS] draft-nir-tls-eap-03

[pgut001 at cs.auckland.ac.nz (Peter Gutmann)]

Yoav Nir <ynir at checkpoint.com> writes:

>1. While I trust TLS implementations to be able to ignore extension
>indications that they don't know (because there are a lot of extensions), I
>think sending an identity buffer in a new handshake message to an
>unsuspecting server may cause problems.

Why?  It's just another extension, the server can throw it away if it doesn't
know what to do with it.

>2. In a browser scenario, you may get redirected to an https page at any
>time. So either your browser stores a fixed identity for all TLS sessions
>that may come, or else you get a pop-up asking for your userid whenever you
>surf to an https site. It only makes sense to query your identity *after* the
>client got an indication from the server that it supports TLS-EAP, or even
>better, after the client verified the gateway's certificate.

Right, but that's very specific to browsers, and assumes an interactive
terminal with a user sitting there able to process messages.  What's the
target audience for this mechanism?  How many years will it be before browsers
even implement this, if they ever implement it at all?  Given EAP's existing
use with secure tunnels in which your VPN software transparently opens a
tunnel to the remote system, and that's it, there's no need for any user-
interaction facility.  I'm not saying it should be scrapped, but that we
should consider how it's likely to be used and optimise it for the most likely
usage scenario(s).

>3. There's lots of stuff only geeks care about, but they're usually right.

When it comes to usability they're usually wrong (and I mean specifically
security geeks vs.interaction designers).  Geeks like building in fancy stuff
that only other geeks would ever care about but that (at best) provides little
benefit for users and (at worst) makes their life much, much harder, and
[insert long rant here, or see Cranor and Garfinkel's book] :-).

Why not just make it an option in the protocol and let implementors decide?
That way the market gets to decide what they consider most important.  An
extra tag in a client hello is a pretty small price to pay...

Peter.
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls