[pkix] More on the deprecation of X.509 client certificates on the Web
Anders Rundgren <anders.rundgren.net@gmail.com> Wed, 16 September 2015 07:18 UTC
Return-Path: <anders.rundgren.net@gmail.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C2A91B3814 for <pkix@ietfa.amsl.com>; Wed, 16 Sep 2015 00:18:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5QQeD_WmyQGy for <pkix@ietfa.amsl.com>; Wed, 16 Sep 2015 00:18:32 -0700 (PDT)
Received: from mail-wi0-x232.google.com (mail-wi0-x232.google.com [IPv6:2a00:1450:400c:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C7311B3813 for <pkix@ietf.org>; Wed, 16 Sep 2015 00:18:31 -0700 (PDT)
Received: by wicfx3 with SMTP id fx3so59046862wic.1 for <pkix@ietf.org>; Wed, 16 Sep 2015 00:18:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=to:from:subject:message-id:date:user-agent:mime-version :content-type:content-transfer-encoding; bh=hbYcGAQjqVut8X8GgoXIYr5AvYSOo+F4lBhIgantlI4=; b=mWXNwua0YrTIvYRxuw3z5SbR8NOrW3hEK+Ll7sK6fCS+dUFQAgZNSqXjuIv2GF8IlG ydCy6KgLDUgBjhTiQn+ky0SeL7QZulq/lgLikA7RNL17Knr+BHUOsEOlpagaLVEFbLAA DDmF6ZxeFtLHOk5LE5pGY92ftlg/jDMB1EcmwFwn/mT+YVheF4y71BAExQu194uB+Dmd rqDesZC4cwLo9YrSJ5FOWcqwTh2DFatE25ju3Y8GrBUNEnemYF57c/140PunSZIOyrv8 2WTa2P+hugGrnX8IJHEooItRVeXMO6y5q41s8n5lyLUtHlu2rLkL8GorDXgIaw1RnQt+ yu3A==
X-Received: by 10.180.182.107 with SMTP id ed11mr15830805wic.52.1442387910268; Wed, 16 Sep 2015 00:18:30 -0700 (PDT)
Received: from [192.168.1.79] (240.196.130.77.rev.sfr.net. [77.130.196.240]) by smtp.googlemail.com with ESMTPSA id fs2sm2867117wib.12.2015.09.16.00.18.29 for <pkix@ietf.org> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 16 Sep 2015 00:18:29 -0700 (PDT)
To: "pkix@ietf.org" <pkix@ietf.org>
From: Anders Rundgren <anders.rundgren.net@gmail.com>
Message-ID: <55F917BC.2060600@gmail.com>
Date: Wed, 16 Sep 2015 09:18:20 +0200
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/pkix/nGPQLoP1wb2rSk1xlhjBxT7QqoQ>
Subject: [pkix] More on the deprecation of X.509 client certificates on the Web
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Sep 2015 07:18:33 -0000
Bard Hill (Facebook security expert): https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0093.html "and it puts authentication at a layer (the TLS handshake) where it is fundamentally problematic to the commonplace scalability and performance architecture of anything but hobbyist-level applications" I agree with this [somewhat exaggerated] statement but taken literally it means that PIV won't (or shouldn't) be used on the Web since HTTPS CCA (Client Certificate Authentication) is the [currently] only solution available.
- [pkix] More on the deprecation of X.509 client ce… Anders Rundgren