[TLS] TLS 1.2 and CertificateRequest message
Nikos Mavrogiannopoulos <nmav@gnutls.org> Thu, 22 October 2009 21:24 UTC
Return-Path: <n.mavrogiannopoulos@gmail.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6E52928C195 for <tls@core3.amsl.com>; Thu, 22 Oct 2009 14:24:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M-TZJheq6lf2 for <tls@core3.amsl.com>; Thu, 22 Oct 2009 14:24:30 -0700 (PDT)
Received: from mail-fx0-f218.google.com (mail-fx0-f218.google.com [209.85.220.218]) by core3.amsl.com (Postfix) with ESMTP id 88BDD28C198 for <tls@ietf.org>; Thu, 22 Oct 2009 14:24:28 -0700 (PDT)
Received: by fxm18 with SMTP id 18so9699681fxm.37 for <tls@ietf.org>; Thu, 22 Oct 2009 14:24:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:message-id:date:from :user-agent:mime-version:to:subject:x-enigmail-version:openpgp :content-type:content-transfer-encoding; bh=cEaTFFyPIt/hsEIF8+rMqH56ikn5uglllTo+oPje8P8=; b=N9sT4IBVCtp9MJ2z96zHAFtq1LtJ2JDnQEJxGAuHGlFgP6xL0oQAD/rG40kqvucy/Q rQ1gci/w0z0k2hkrKo1oNXZg6bs8nA0o58FZr5j7q/scpGc+NVvQMZQnNf8o6WwWl3Kc gOKYF+lKx26/MgP3NW/YFy6WWvvBnrOPihIPg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:subject :x-enigmail-version:openpgp:content-type:content-transfer-encoding; b=nQWtfVwyi7oOXfT8yMtzeMtmzgThf2IdmjsrpY4G+wmDiTM3TiWPeavFLlzcDOYVfO KZz0iJukdvj4da/+slKthJbeHukR5SZOvws41b9usY498HdI0syC2TdQyqOulZqxz4fe QQEVHADNMGV2Mb9Mo/eFdvHZDouKHND45mZEE=
Received: by 10.204.160.86 with SMTP id m22mr9936009bkx.82.1256246675188; Thu, 22 Oct 2009 14:24:35 -0700 (PDT)
Received: from ?10.100.1.196? (adsl18-228.ath.forthnet.gr [77.49.209.228]) by mx.google.com with ESMTPS id 19sm1932002fkr.53.2009.10.22.14.24.33 (version=SSLv3 cipher=RC4-MD5); Thu, 22 Oct 2009 14:24:34 -0700 (PDT)
Sender: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Message-ID: <4AE0CD8F.6000508@gnutls.org>
Date: Fri, 23 Oct 2009 00:24:31 +0300
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
User-Agent: Thunderbird 2.0.0.23 (X11/20090817)
MIME-Version: 1.0
To: tls@ietf.org
X-Enigmail-Version: 0.95.7
OpenPGP: id=96865171
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Subject: [TLS] TLS 1.2 and CertificateRequest message
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 22 Oct 2009 21:24:31 -0000
Hello, I've been taking a look at TLS 1.2 and it seems that there is some new negotiation added at the CertificateRequest message. At this message the server is supposed to send a list of allowed algorithm for signature calculation, and the client should respond with a signature that depends on the previously exchanged handshake messages. In previous versions of TLS a client could just start the hash calculation for this signature during the exchange to avoid storing the actual messages up to this point. However with this negotiation at this point it is quite impossible to do that approach and as far as I understand needs to follow the store approach. My questions now are: 1. How is this implemented in compliant software today? 2. Why this negotiation was added? I see no added value of having such negotiation at a so late point. regards, Nikos
- [TLS] TLS 1.2 and CertificateRequest message Nikos Mavrogiannopoulos
- Re: [TLS] TLS 1.2 and CertificateRequest message Michael D'Errico
- Re: [TLS] TLS 1.2 and CertificateRequest message Nikos Mavrogiannopoulos