Re: [quicwg/base-drafts] Text banning post-handshake client auth is unclear (#2367)

[Martin Thomson <[e-mail]>]

@mikkelfj, The best way to understand the rationale is to try to work through how a particular protocol might use this feature.  Read [HTTP/2 secondary certificate authentication](https://httpwg.org/http-extensions/draft-ietf-httpbis-http2-secondary-certs.html), look at the design and discussion and see the sorts of problems it tries to address.  In that case, some of the problems are with server-authentication, which you can safely ignore, but the general class of problems related to concurrency and how that relates to the status of authentication produce a fairly complex design.

Now I might concede that it is possible to build a protocol that uses this TLS feature well, but I would still hold that [exported authenticators](https://tlswg.github.io/tls-exported-authenticator/draft-ietf-tls-exported-authenticator.html) are a far superior design.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2367#issuecomment-457001043