[TLS] TLS Cached Information Extension - version 11

[Hannes Tschofenig <[e-mail]>]

Hi all,

Nikos provided review comments (see 
http://www.ietf.org/mail-archive/web/tls/current/msg08338.html) and I 
have incorporated them in version 11 of the draft:
http://www.ietf.org/internet-drafts/draft-ietf-tls-cached-info-11.txt

As you can see, there are a number of smaller changes here and there. I 
hope that readability has improved.

There is an open issue: algorithm negotiation

Currently, the draft defines a registry for hash algorithms that are 
used to produce the hashes of cached information. The client can tell 
the server that it has already cached, for example, the certificate 
chain. The server then has to only send the fingerprint of it (rather 
than the complete certificate chain). The other information (besides 
certificate chains) that can be "fingerprinted" is the list of trusted 
CAs. Does this cover all use cases?

A few algorithms are defined, namely SHA-1, SHA-224, SHA-256, SHA-384, 
SHA-512. Is this a good list to start with?

The draft does not define a way for the client to tell the server that 
it only supports a certain hash algorithm. Should we allow the client to 
indicate what algorithm it supports?

Ciao
Hannes