Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Roland Zink <[e-mail]>]

On 25.01.2015 05:05, Peter Gutmann wrote:
> Aaron Zauner <[e-mail]> writes:
>
>> That's a nice trick but as you point out pretty useless in terms of a PKI.
> It's done solely to deal with browsers, which demand to see a certificate when
> they're connecting to something via TLS.
>
> (Aside: You can see why some people think the CA/Browser forum as a conspiracy
>   to force the use of certs, despite there being very good alternatives
>   available browsers force you to use certificates whether they're appropriate
>   or not).
You probably need to blame IETF for this, for example RFC2818 (HTTP Over 
TLS) states:


      3.1 <http://tools.ietf.org/html/rfc2818#section-3.1>. Server Identity

In general, HTTP/TLS requests are generated by dereferencing a URI. As a 
consequence, the hostname for the server is known to the client. If the 
hostname is available, the client MUST check it against the server's 
identity as presented in the server's Certificate message, in order to 
prevent man-in-the-middle attacks.

Regards,
Roland