Re: [TLS] New Version Notification for draft-wouters-tls-oob-pubkey-01.txt (fwd)

[Paul Wouters <[e-mail]>]

On Fri, 18 Nov 2011, Badra wrote:

>             And how does draft-wouters-tls-oob-pubkey differ from draft-ietf-tls-cached-info-09?
> 
> cached-info still needs PKIX validation on the first run, and then supports caching
> the authentication. oob-pubkey allows for out of bound public key authentication
> with tls server suppressing the sending of its (often huge) unneeded PKIX chain.
> 
> 
> 
> And how, in your draft, will the client have a copy of server's authenticated key? 

The draft is called "out of band" for a reason :)

One method is to get it via DANE/DNSSEC, for example:

dig -t TYPE65468 _443._tcp.dane.xelerance.com

That will give the client an authenticated hash of the public key. During the TLS
handshake, the TLS server gives the TLS client its public key in the server certificate
of cert_type "RawPublicKey".

The DANE draft does not (yet) have a subtype for "raw key" but is expected to get one as
soon as TLS defines the cert_type (which this draft would do)

> Currently, the server doesn't need to describe known roots. Does it mean that the server also has a copy of the client's authenticated key?

If the TLS server wants to authenticate the TLS client, it will also need and out-of-band
authentication. The TLS client will send its public key in a certificate of cert_type="RawPublicKey"
and the TLS server will have to lookup that key for authentication. (to make that easier on
the server, perhaps we can think about the client version of "SNI", but we left that out of
this draft not to complicate things at this stage)

Paul