IETF Logo Mail Archive

Re: [TLS] Updating for non-X.509 certificate types

Andrei Popov <Andrei.Popov@microsoft.com> Fri, 10 March 2017 18:53 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 299BA1295B2 for <tls@ietfa.amsl.com>; Fri, 10 Mar 2017 10:53:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.022
X-Spam-Level:
X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nE2bBI73N0IX for <tls@ietfa.amsl.com>; Fri, 10 Mar 2017 10:53:03 -0800 (PST)
Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0096.outbound.protection.outlook.com [104.47.32.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BCBA12952C for <tls@ietf.org>; Fri, 10 Mar 2017 10:53:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0yGgv0eRO8BqIG3Y6H7K7FI21QEYh+XyhfID/en7tUI=; b=RMt4GC/NPeSTV0nKwsIgJRSsRuhDG4xqZ408OzfpxwkycVk0f2Xuh1PsKuwj1188HHxD76Yaq51lCowogU3cuHUrMWT4Flyujb5C7GIt1gdxAfpe3/EBm3PQrWXan9gwhXrCVQNahZQCC67N5tvRG2Div48AG85Y7RPRsGRlEj0=
Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0090.namprd21.prod.outlook.com (10.161.141.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.2; Fri, 10 Mar 2017 18:53:01 +0000
Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.0977.006; Fri, 10 Mar 2017 18:53:01 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: "ilariliusvaara@welho.com" <ilariliusvaara@welho.com>
Thread-Topic: [TLS] Updating for non-X.509 certificate types
Thread-Index: AQHSmUYgLR+P/8VK8EmBfveqy8TqsqGOBGCAgAAntwCAABqeAIAAAWYAgAAV3vCAAAusgIAAAPvw
Date: Fri, 10 Mar 2017 18:53:01 +0000
Message-ID: <DM2PR21MB0091DF660A5BF41381701F708C200@DM2PR21MB0091.namprd21.prod.outlook.com>
References: <CABcZeBNGkZVpoGqkc_ePF12mC0HaJgNbytXV70eV4oBBcyD2HQ@mail.gmail.com> <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBNuVB1pdZiQmn87asfF=ARgNNTkzVM2vnyZZ1VPJ4-B+g@mail.gmail.com> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBPeRYSVOXRm4rReQ-f3E1giJYiVgwJ4PmEOP7zaiZiRdQ@mail.gmail.com> <DM2PR21MB00914AC3F20BF3D8E266F0768C200@DM2PR21MB0091.namprd21.prod.outlook.com> <20170310184241.GA5016@LK-Perkele-V2.elisa-laajakaista.fi>
In-Reply-To: <20170310184241.GA5016@LK-Perkele-V2.elisa-laajakaista.fi>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: welho.com; dkim=none (message not signed) header.d=none;welho.com; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [2001:4898:80e8:5::1d2]
x-microsoft-exchange-diagnostics: 1; DM2PR21MB0090; 7:y9lFPyD/A3cVc0h86kMkh87tqt1Si5/CkuIVwCWNiyW1HAm0F0wxCSz0n1m5HJEcGazeI+hDeAMs5fYt3r+QdVfGMSpT9aQyCHV7TyE9IcHNILlzcebhBeD0y2dVEX0Zl8gO5ceUautnwJ1HyoaM/WpYoTCz4+/IqClD52ZdMtxYoGperUnRj48sUq3lzmJtBqal6uxvEc5aVw9ebezGKlhUQ5tIQs7ANU5VBUws5JE9zF3dQeDr4wzWskbfUtGCa+n5mXR3s5+SblfBm4+C0P+cAs6E5X95f6vQ0bwZmpwswIS1Iayk6PNICwIaP9gaAo974wzVvj6Jx/sd0JEvjkwIrsSRMH8Uk7UrH5Ji0DI=
x-ms-office365-filtering-correlation-id: 18e7fefe-eb9e-40d4-5a3c-08d467e6ad8e
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:DM2PR21MB0090;
x-microsoft-antispam-prvs: <DM2PR21MB0090BB023288B3C14E9498988C200@DM2PR21MB0090.namprd21.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123558025)(20161123562025)(20161123564025)(6072148); SRVR:DM2PR21MB0090; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0090;
x-forefront-prvs: 02426D11FE
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(6009001)(39850400002)(39860400002)(39840400002)(39450400003)(39410400002)(377454003)(13464003)(24454002)(122556002)(8990500004)(5005710100001)(6116002)(189998001)(33656002)(2906002)(102836003)(50986999)(54356999)(76176999)(53546006)(38730400002)(2351001)(110136004)(6246003)(53936002)(4326008)(81166006)(2501003)(10290500002)(8936002)(1730700003)(8676002)(3280700002)(6436002)(25786008)(5640700003)(229853002)(106116001)(77096006)(3660700001)(6506006)(7736002)(10090500001)(2900100001)(305945005)(93886004)(9686003)(54906002)(55016002)(99286003)(86612001)(6916009)(86362001)(2950100002)(5660300001)(74316002)(7696004)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0090; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2017 18:53:01.5747 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0090
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/AEJPFiCpR4ydfLUGA-Vtl5UdiuU>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Updating for non-X.509 certificate types
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Mar 2017 18:53:05 -0000

Well, admittedly neither user_mapping, nor cert_type is hugely popular. 
It would not make sense for the TLS 1.3 spec to be on hold until these extensions are reconciled with it.

However, I do think that a TLS 1.3 ClientHello should be able to advertise extensions that are not defined for TLS 1.3, when the client is willing to accept TLS<=1.2.

Cheers,

Andrei

-----Original Message-----
From: ilariliusvaara@welho.com [mailto:ilariliusvaara@welho.com] 
Sent: Friday, March 10, 2017 10:43 AM
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: Eric Rescorla <ekr@rtfm.com>; tls@ietf.org
Subject: Re: [TLS] Updating for non-X.509 certificate types

On Fri, Mar 10, 2017 at 06:04:54PM +0000, Andrei Popov wrote:
> Ø  Does anyone use this?
> 
> Ø  I don't think anyone uses it.
> 
> Au contraire: Windows TLS stack supports user_mapping and this 
> mechanism appears to be somewhat in use. However, I agree that this 
> falls into the category of extensions that need to be either 
> deprecated or redefined for TLS 1.3.

Oh, sorry, quoting context fail: I meant that nobody uses cert_type, not that nobody uses user_mapping.


-Ilari

v2.23.0 | Report a Bug | By Email