Re: [Secdispatch] Requesting agenda time for draft-halen-fed-tls-auth

[Michael Richardson <[e-mail]>]

Stefan Halen <stefan.halen=[e-mail]> wrote:
    > The metadata is also used for discovery. The client normally select a
    > server based on metadata claims (e.g., organization, tags). The client
    > connects to the server's base_uri, also found in metadata.

    > The federation operator must keep track of the members and which
    > combinations of tags and peer type each member may publish.

    > To enable self-signed certificates, there is the possibility of
    > publishing issuers.

Perhaps I'll understand the problem more after you revise the document, or
maybe your slides will motivate things.  I am generally enthusiastic about
anything that pushes for more use of mutual TLS authentication!

I understood part of the solution, but I completely did not understand what
problem you are dealing with!!!

    > Issuers are for reverse proxys that do not support optional_no_ca. Pin
    > validation is performed by the application

If I understood this comment, the issue is that are TLS terminating proxies
that can only validate client TLS certificates from CAs that they have been
configured with.

They can not opportunistically use a certificate provided in the TLS setup to
complete the TLS connection, and then allow an application framework behind
them to indicate if the client certificate should have been accepted or not.

I don't yet understand how your protocol solves this, but I think that
RFC8995 could suffer from this constraint in the Registrar->MASA connection.

https://datatracker.ietf.org/doc/draft-bdc-something-something-certificate/
tried to find a place to be adopted, and I think that had it gotten somewhere
that it might have helped you.
(Yes, there are issues of how to make this work with TLS 1.3 re-authentication)

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-