Re: [rtcweb] DTLS version for RTCweb

[Tim Panton <[e-mail]>]

On 10 May 2013, at 10:24, Olle E. Johansson wrote:

> 
> 10 maj 2013 kl. 11:12 skrev "Olle E. Johansson" <[e-mail]>:
> 
>> 
>> 10 maj 2013 kl. 11:08 skrev Tim Panton <[e-mail]>:
>> 
>>> 
>>> 
>>> On 9 May 2013, at 22:46, Marc Petit-Huguenin wrote:
>>> 
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA256
>>>> 
>>>> I read the various security drafts and it looks like they all reference DTLS
>>>> 1.0 (RFC 4347), but RFC 4347 was obsoleted by RFC 6247.  So will the
>>>> references being updated to use DTLS 1.2 as the base version, or will DTLS 1.0
>>>> stay as the base version, with possibility of negotiation to 1.2 and higher?
>>> I think we should move to 1.2 - There are specific cases where 1.0 doesn't exactly do what we
>>> want. 
>>> 
>>> e.g. I think for a server to ask for a client cert, technically in 1.0 you are supposed to list the CA's
>>> you are interested in and you'll only receive certs from those CAs. In 1.2 you can leave this
>>> empty and get a list of all certs (effectively a CA wildcard). 
>> 
>> What? Will any server get a list of all my private certs? That sems to me like a big fat privacy issue.
> From RFC 5246 (TLS 1.2) that DTLS 1.2 refers to:
> 
> "If
>      the certificate_authorities list is empty, then the client MAY
>      send any certificate of the appropriate ClientCertificateType,
>      unless there is some external arrangement to the contrary."
> 
> This doesn't mean that you will get all, but that the client can select any certificate in the 
> cert store to present to the server. Previously the server had to present a list of 
> acceptable CAs. It does open for self-signed certs, really. If you by other means have
> established trust for a self-signed cert, you can use it as a client cert in TLS 1.2. The
> server doesn't have to trust a CA, but can trust a specific cert.
> 
> This goes hand in hand with DANE.
> 
> /O

But that language isn't in TLS 1.0 - the list can't be empty.

T.