Re: [TLS] Summarizing identity change discussion so far

Peter Saint-Andre <> Fri, 18 December 2009 02:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 57DF13A6A1B for <>; Thu, 17 Dec 2009 18:50:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id rfUq9P8Ke4JJ for <>; Thu, 17 Dec 2009 18:50:37 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 3C1B33A68B8 for <>; Thu, 17 Dec 2009 18:50:37 -0800 (PST)
Received: from ( []) (Authenticated sender: stpeter) by (Postfix) with ESMTPSA id 1057240332; Thu, 17 Dec 2009 19:50:21 -0700 (MST)
Message-ID: <>
Date: Thu, 17 Dec 2009 19:50:22 -0700
From: Peter Saint-Andre <>
User-Agent: Thunderbird (Macintosh/20090812)
MIME-Version: 1.0
To: Michael Gray <>
References: <>
In-Reply-To: <>
X-Enigmail-Version: 0.96.0
OpenPGP: url=
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="------------ms060200040708070905070600"
Cc:, Kyle Hamilton <>
Subject: Re: [TLS] Summarizing identity change discussion so far
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 18 Dec 2009 02:50:38 -0000

On 12/17/09 3:39 PM, Michael Gray wrote:
> wrote:
>> Kyle Hamilton wrote:
>>> On Tue, Dec 8, 2009 at 1:13 AM,  <> wrote:
>>>> (wearing Area Director hat)
>>>> - We recommend that TLS libraries SHOULD provide identity matching
>>>> (with memcmp, abort handshake if changed) functionality to
>>>> applications, and SHOULD allow applications to enable/disable this
>>>> functionality.
>>> No, identity matching SHOULD be done in accordance with PKIX.  memcmp
>>> is not at all sufficient.
>>> However, I would support the following:
>>> - TLS libraries SHOULD provide identity matching services between and
>>> throughout renegotiation handshakes.  Libraries SHOULD implement this
>>> in accordance with PKIX [PKIX], but MAY do so with a direct memory
>>> comparison.  Implementors are cautioned that this latter approach does
>>> not provide for changing the cipher parameters -- such as a
>>> renegotiation with an EC or DH certificate after identification with
>>> an RSA certificate.  If the identity matching service fails to match
>>> the identity, implementations MUST abort the handshake with a fatal
>>> bad_certificate alert.
>> The way the TLS specifications are currently archtected, this is
>> a service that is _not_ available from TLS.
>> Although there is likely some PKI(X)-Software available to the
>> TLS implementation for the X.509 stuff and certificate path validation
>> processing, but it can easily be that it is a completely different
>> module.
>> If an application currently wants to look at the contents of
>> the certificates exchanged and authenticated during the TLS handshake,
>> then this is explicitly declared out-of-scope for TLS in the base spec
>> (RFC-5246, section 1. last paragraph).  I would strongly recommend
>> to leave the code slicing (modularization) between application,
>> PKI-Software and TLS-implementation outside the scope of this spec.
> Yes the problem is defining what an identity change is precisely.  We know
> that CA's load all sorts of stuff in to certificates as part of the DN etc
> and the same identify could have multiple certificates, and could be
> identified by multiple CAs.  If we say that in TLS we are going to check
> identity then it has to be very precisely defined, or extremely vaguely
> defined so that the implementation can not be accused of non compliance or
> invalid/suspect identity matching.  Perhaps it needs to be a vague as
> possible so that TLS implementation can simply push it back to the
> application layer in practice

As previously expressed, I think this belongs at the application layer.


Peter Saint-Andre