Re: [quicwg/base-drafts] Clarify why post-handshake client auth is banned (#3044)

[Martin Thomson <[e-mail]>]

martinthomson approved this pull request.

I'm going to say that this is editorial-enough to just merge.  MUST NOT implies PROTOCOL_VIOLATION, so the new normative language is fine as editorial.  I'll give others a chance to disagree though.

> @@ -612,8 +612,13 @@ MAY refuse a connection if the client is unable to authenticate when requested.
 The requirements for client authentication vary based on application protocol
 and deployment.
 
-A server MUST NOT use post-handshake client authentication (see Section 4.6.2 of
-{{!TLS13}}).
+A server MUST NOT use post-handshake client authentication (as defined in
+Section 4.6.2 of {{!TLS13}}), because the multiplexing offered by QUIC prevents
+clients from correlating the certificate request with the application-level
+event which triggered it (see {{?HTTP2-TLS13=I-D.ietf-httpbis-http2-tls13}}).

CMOY (cite my own work) alert.  :)

Also a CMOS tweak (Chicago Manual of Style) tweak:
```suggestion
event that triggered it (see {{?HTTP2-TLS13=I-D.ietf-httpbis-http2-tls13}}).
```

> @@ -612,8 +612,13 @@ MAY refuse a connection if the client is unable to authenticate when requested.
 The requirements for client authentication vary based on application protocol
 and deployment.
 
-A server MUST NOT use post-handshake client authentication (see Section 4.6.2 of
-{{!TLS13}}).
+A server MUST NOT use post-handshake client authentication (as defined in
+Section 4.6.2 of {{!TLS13}}), because the multiplexing offered by QUIC prevents
+clients from correlating the certificate request with the application-level
+event which triggered it (see {{?HTTP2-TLS13=I-D.ietf-httpbis-http2-tls13}}).
+More specifically, servers MUST NOT send post-handshake TLS CertificateRequest
+messages, and clients MUST treat receipt of such messages as a connection error

```suggestion
messages and clients MUST treat receipt of such messages as a connection error
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044#pullrequestreview-289075027