Re: [TLS] Status of X.509v3 TLS Feature Extension?

[Phillip Hallam-Baker <[e-mail]>]

I just submitted an update to keep it current.

http://www.ietf.org/id/draft-hallambaker-tlsfeature-03.txt


The issue is not the OID, it is support in the browsers. If there is
support from one browser provider we can get backing to publish the
draft. Without implementation in at least one of the browsers it does
not help.




On Thu, Apr 24, 2014 at 3:55 PM, Klemens Baum <[e-mail]> wrote:
> After the whole Heartbleed incident, it has become obvious that the
> current mechanisms for Certificate Revocation are inadequately
> enforced by clients.
>
> To combat the issue, it would seem desirable for a security-conscious
> server operator to be able to require the use of OCSP stapling on a
> per-certificate basis. There was already an Internet-Draft (now
> expired) for an X.509v3 extension which would provide this feature:
> https://datatracker.ietf.org/doc/draft-hallambaker-tlsfeature/
>
> Clients supporting the extension could display an enhanced security
> indicator (e.g. "Certificate Status: Not revoked") for certificates
> carrying the extension which pass validation, which would also
> motivate more widespread adoption of OCSP stapling in favor of CRLs
> and client-initiated OCSP requests.
>
> Since the draft looked very promising, I suggest that it should be
> unexpired. If anyone with the authority to do so agrees, please submit
> a request for resurrection per the guidelines at
> http://www.ietf.org/ietf-ftp/1id-guidelines.txt.
>
> A few minor clarifications may still be needed so that it can be
> quickly implemented by major browsers and the CAs:
>
> - The tls-feature OID is currently specified with a value of { id-pe 1
> }, which corresponds to 1.3.6.1.5.5.7.1.1 (authorityInfoAccess, itself
> already an X.509v3 extension). Surely a new OID in the
> pkix.privateExtension arc will need to be allocated by IANA and if
> this is the case, it should be noted in the section "IANA
> Considerations".
>
> Please share your opinions!



-- 
Website: http://hallambaker.com/