Re: [TLS] Proposal for hybrid solution using most of the ideas

[Stephen Farrell <stephen.farrell at cs.tcd.ie>]

Nasko Oskov wrote:
>> Which leaves us with S->C signaling. Here I'm not sure we have exhausted all options.
> 
> Yes, we might be missing something else. The reason I picked the Certificate
> message is that it is dynamic size by default, so we don't have to alter
> existing data, just append.

Sorry, I'm not clear on what's being proposed here. Is it:

a) embed a new flag of some sort in a CA-issued X.509 cert
b) add an additional server-generated self-signed cert containing
   a new flag of some sort
c) something else?

I think (a) would be a bad idea. Not sure about (b) either, but
at least it wouldn't bring a whole new bunch of parties to the
table (CA product vendors and service providers) when something
quick is what's needed.

Stephen.