Re: Report on preliminary decision on TLS 1.3 and client auth

[Amos Jeffries <[e-mail]>]

On 24/09/2015 3:41 p.m., Martin Thomson wrote:
> On 23 September 2015 at 19:02, Amos Jeffries wrote:
>>
>> Option 2 risks the same mess if the AUTH frame is defined end-to-end.
>> But a per-hop frame would work nicely as long as it is clear to server
>> implementers that intermediaries may be the source of the certificate.
>> Not some "user".
> 
> This would naturally be hop-by-hop, by virtue of extensions being
> hop-by-hop and by virtue of the setting that enables it also being
> hop-by-hop.
> 
>> An option 3 might be to use a SETTINGS instead of dedicated AUTH frame.
>> So that the per-hop nature is made extra clear. That would also be more
>> backward compatible with older h2 implementations and work in with
>> clearing dynamic compression contexts at the same time as authenticating.
> 
> SETTINGS wouldn't allow the server to correlate the CertificateRequest
> with a specific request/response exchange.

Ah. Sorry I seem to have misunderstood yoru meaning of "provides the
proof that a server needs to regard the entire session to be authentic"
to mean the cert was connection-wide.

If it is stream-specific in terms of HTTP/2 streams rather than TLS
streams, then the frame as in option 2 should be okay. Option 1 still
has major issues with www-auth vs proxy-auth.

> 
> Also, while I think of it, we should probably forbid the use of this
> on server-initiated streams (i.e., with server push).  That could
> cause problems.
> 

I can see that as being a SHOULD NOT, or forbid on PUSH_PROMISE
specifically. But using a more general definitio like "server initiated"
may cause conflicts with the bi-directional h2 extension.

Amos