Re: [pkix] fyi: Sovereign Keys: an EFF proposal for more secure TLS

[Martin Rex <[e-mail]>]

Adam Langley wrote:
> 
> Rob Stradling <[e-mail]> wrote:
> >
> > I've thought of a couple of other ways of wedging the data into the TLS
> > handshake, although these methods would require more collaboration from
> > the CAs than you've thus far intended to require (or perhaps expected).
> 
> Because of this, wedging the data in afterward, while technically
> obnoxious, is much easier to deploy, assuming that we can get the
> client compatibility. (I also promise to leave extension space for
> others if we end up using some trick!)
> 
> Thanks to your hint, I've confirmed that Android < 2.2 rejects
> certificate chains with superfluous certificates. Thankfully, we can
> typically wait a while in order to get rid of phones but I'm also
> taking a look at other ways in which to squeeze the data.

The obvious solution is to use a TLS extension.  I fail to see
a reason why a TLS extension would not be the appropriate tool.

I am very strongly opposed to stuffing protocol extensions encodes
as X.509v3 into *regular* TLS Certificate handshake messages,
because it is a clear violation of the protocol and it would is a
perfectly sensible behaviour for a TLS peer to abort the TLS handshake
if being served a *regular* Certificate handshake message that does not
contain a well formed, ordered and valid certfication path.


-Martin