Subject: [TLS] draft-sullivan-tls-exported-authenticator-00

From: Nick Sullivan <[email-masked]>
Date: Mon, 31 Oct 2016 21:29:19 +0000

<https://tools.ietf.org/html/
<https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00>
draft-sullivan-tls-exported-authenticator-00>
<https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00>

I just posted a new Internet-Draft called "Exported Authenticators in TLS"
in the TLS working group.

The intent of this draft is to enable participants in a TLS connection to
prove ownership of additional certificates. This differs from previous
proposals (https://tools.ietf.org/html/draft
-sullivan-tls-post-handshake-auth-00) in that these proofs are not sent as
part of the TLS connection, but instead exported so that they can be sent
out of band (as part of an application layer message, for example).

This proposal should enable a radical simplification of the Secondary
Certificate Authentication in HTTP/2 proposal (
https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-01),
and should generally be a useful tool for binding a certificate ownership
proof to a TLS connection.

Nick Sullivan

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 31 Oct 2016 23:57:16 +0200

> proof to a TLS connection.

This looks A LOT saner than the current post-handshake stuff in TLS 1.3
draft. Looks implementable even.

One comment about API: There should be a method to query the TLS library
capabilities with CertificateVerify algorithm verification.

The result could e.g. be list of algorithm numbers (e.g. 0403, 0503,
0603, 0804, 0805, 0806, 0807, 0808).

Also one bit unclear thing: Is RSA-PKCS1#v1.5 allowed if negotiated
TLS version is 1.2?

-Ilari

---

From: Nick Sullivan <[email-masked]>
Date: Mon, 31 Oct 2016 22:08:37 +0000

On Mon, Oct 31, 2016 at 2:57 PM Ilari Liusvaara <[email-masked]>
wrote:

> > <
> https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00>
> > <
> https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00>
> >

> The result could e.g. be list of algorithm numbers (e.g. 0403, 0503,
Good idea.

> Also one bit unclear thing: Is RSA-PKCS1#v1.5 allowed if negotiated
I'd say yes, since it's the only RSA signature type supported in TLS 1.2.
It's not allowed in TLS 1.3.