Re: [TLS] Summary of discussion regarding spontaneuous authentication

[Martin Thomson <[e-mail]>]

I forgot one point that we discussed.

We discussed the removal of the CertificateRequest and we will permit
the client to unilaterally send authentication.

The theory here is that clients tend to know whether they need to
authenticate.  Most uses of mutual authentication start with the
client knowing that they need to authenticate.  Anything more
complicated will require some application protocol signals.

This also avoids the deficiencies with CertificateRequest, allowing -
or requiring - application protocols to provide equivalent
functionality if that is desired (see my -cant proposal for one
potential way to do that).

On 22 October 2014 03:04, Martin Thomson <[e-mail]> wrote:
> The update proposal that ekr sent around was discussed.
>
> The primary concern was that the properties of the connection were
> considered to change with respect to authentication.  Any data
> received before the authentication, or messages that appear partially
> before and partially after would have ambiguous properties.
>
> Concerns were raised that having the authentication attest to data
> that was sent prior to the authentication would expose us to a variety
> of attacks that relied on confusion about the state of the connection.
> There was also a concern that this would be difficult to analyse.
>
> It was pointed out that update was still interesting, but only from a
> rekeying perspective, because that had far lesser risks and no real
> API implications.
>
> If we decided to continue with Update, then we would have a place to
> add a future extension that re-enabled this feature.
>
> I noted that the use case that renegotiation provides was not going to
> be supported with the proposed Update message, since there was no
> analogue for the HelloRequest message.
>
> All of this led to the decision not to pursue spontaneous authentication.