Re: [CHANNEL-BINDING] TLS endpoint channel bindings in SCRAM

[<[e-mail]>]

Nicolas Williams wrote:

> Questions:
> 
> 1) Do many/most/all TLS implementations output the DER-encoded form of
>    the server cert?  Which ones do/don't?
> 
> 2) Is the cert used on the wire generally NOT DER-encoded?  If so, how
>    hard would it be to change this?  (e.g., re-encode the cert and
>    restart apps?)

Although the TLS spec doesn't explicitly say this, the on-the-wire
certificate is DER encoded. There's no field specifying what the
encoding is, so if you attempt sending PER or XER, it simply won't
work.

Some implementations might accept some limited subset of BER (to
work around CA bugs), but even in those cases, nobody's going to
re-encode it to DER (most likely the CA calculated the signature over
BER encoded version -- violating all possible standards -- and the
API would return the octets sent on the wire).

So I don't see any problem in using the tls-server-end-point channel
binding... (and it seems it would work for OpenPGP, too)

Best regards,
Pasi