Re: [TLS] Client certificate authentication and draft-ietf-tls-oob-pubkey

Hi Paul,

Can you submit an updated draft with the clarification that support for client auth is only through SPKI lookups?  Then we can take the draft to WGLC.  

Thanks,

Joe  
On Apr 11, 2012, at 11:10 AM, Paul Wouters wrote:

> On Wed, 11 Apr 2012, Jim Schaad wrote:
> 
>>> Oops. I checked draft-wouters-tls-oob-pubkey-00 and it was already
>>> removed there after discussion with EKR in Quebec City.
>> 
>> If this is really what you want to do, then I would suggest that the
>> document be expanded so that there exists the possibility to include an
>> identifier and/or a public key in the certificate form defined by the oob
>> document.
> 
> Personall, I strongly prefer not adding more fields to the bare key certificate
> type, as those people who want to cover client authentication can use
> full PKIX certs already, and TLS client authentication in the wild seems
> to be extremely rare. The only two cases I knew are CAcert and Fedora
> (and for the latter it does not even add security, as I need to identify
> with another factor anyway (yubikey))
> 
> Is there an actual use case where bare keys would be preferable over
> full PKIX, that also include client auth not based on burned in keys
> covered by server side SPKI lookups?
> 
> Paul
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls