Re: [POSH] Comments/questions on draft-miller-posh-00

[Philipp Hancke <[e-mail]>]

Am 27.07.2013 19:22, schrieb Peter Saint-Andre:
>> Similarly, I can't see anything obviously wrong with letting the
>> application handshake complete, then performing the POSH
>> operations before deciding the application connection is not
>> suitable and should be terminated before being used.  Is the MUST
>> in this section mandating the order of operations necessary for
>> some other reason?
>
> As mentioned above, the MUST here is perhaps a bit silly because it's
> so obvious. I think there is a better way to word it...

It isn't. In server-to-server XMPP what is typically done is to let the 
tls handshake succeed and only offer sasl external if the peer 
certificate is "valid". The same could be done for POSH... after the 
handshake is complete, look at the verification result. If it is valid, 
send stream features including external; if not, do the POSH dance.

That would typically be done in the application, not the TLS lib. Doing 
an asynchronous https request inside the verification is not something I 
would expect to be trivial.