Re: [TLS] Re: Russ Housley: Fwd: problems with draft-ietf-tls-openpgp-keys-10.txt

Nikos Mavrogiannopoulos <nmav@gnutls.org> writes:
> On Wed 28 Jun 2006 15:48, Stephen Kent wrote:
>> >RFC2818 is a document that proposes a way on how to use HTTP over
>> > TLS. This is not the purpose of this document.
>
>> TLS is the IETF version of SSL.  SSL, like PGP (vs. OPGP) was not
>> born in a standards environment, but rather existed prior to IETF
>> involvement. The description of how to use the ID data from an X.509
>> cert to provide authentication for a web server is an important part
>> of the semantics of SSL and TLS. 
>
> I disagree with that. Why do I have to cope with HTTP? I didn't write
> this extension to use openpgp keys with web browsers. Sure this could be
> done, but then the ones that need this functionality should write the
> rules. I am not interested in that.

I think I have to agree with Nikos here. TLS (2246 and 4346) are
deliberately agnostic about how to determine whether a certificate
matches the expected client or server. That is relegated to 
the upper layer protocol, in the case of HTTP it's described
in RFC 2818. So, I don't think that the document in question
needs to specify this.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls