[TLS] FWD: First TLS cached information draft posted

Sean Shen <sshen@huawei.com> Tue, 09 June 2009 00:58 UTC

Date: Tue, 09 Jun 2009 08:58:13 +0800
From: Sean Shen <sshen@huawei.com>
To: TLS@ietf.org
Message-id: <001201c9e89d$5db40c40$800c6f0a@china.huawei.com>
MIME-version: 1.0
Content-type: multipart/alternative; boundary="Boundary_(ID_9QrrR5XriHIXUsuNxNghFA)"
Thread-index: AcnlO6PBlXmAY4WdFEeoge4+B0iYEgCsiy/QACvXePA=
Subject: [TLS] FWD: First TLS cached information draft posted
Precedence: list

It looks this message was not sent out successfully, have to try it again.
 


  _____  

发件人: Sean Shen [mailto:sshen@huawei.com] 
发送时间: 2009年6月8日 12:08
收件人: 'Stefan Santesson'; 'TLS wg'
主题: 答复: [TLS] First TLS cached information draft posted


Hi, Stefan,
I support the idea and like the benefit of not transporting Certs.
The drafts looks good and clear to me, except that I get some questions
regarding the following part in section 4:
 
   Servers that receive an extended client hello containing a
   "cached_information" extension, MAY indicate that they support one or
   more of the cached information objects by including an extension of
   type "cached_information" in the (extended) server hello, which SHALL
   contain at least one CachedObject received from the client. The
   CachedObject's returned by the server MUST include the types the
   server supports and has accepted to replace with a hash of the cached
   data. 
 
It gives me impression that server's reply can include items that is beyond
cached items which 
clients provide. Is it possible (or leagal) for clients to use those items
which he did not 
mentioned but were indicated usable by server? 
For example clients provides items {A, B}, server replied {B, C}. 
B has been confirmed by both sides, C is confirmed only by Server. If B and
C are both acceptable, 
but the two negotiation base are not quite same, will there be a problem ?
Not quite sure it would 
cause trouble or not though, but wondering whether it will.
For example, since hello message are not crypto protected yet, is it
possible for a man-in-middle to 
let clients accept expired certs or fake CAs?
 
Sean
 
 



  _____  

发件人: tls-bounces@ietf.org [mailto:tls-bounces@ietf.org] 代表 Stefan
Santesson
发送时间: 2009年6月5日 1:41
收件人: TLS wg
主题: [TLS] First TLS cached information draft posted


I have finally incorporated the agreed changes to what previously was called
the cached certs extension, now changed to the cached information extension,
and submitted the first (00) TLS draft.

The draft is available from the following staging URL until it’s made
available as a TLS draft.
http://www.ietf.org/proceedings/staging/draft-ietf-tls-cached-info-00.txt

I hope I didn’t miss any agreed changes.

/Stefan

[TLS] FWD: First TLS cached information draft pos… Sean Shen
Re: [TLS] FWD: First TLS cached information draft… Simon Josefsson
Re: [TLS] FWD: First TLS cached information draft… Sean Shen
Re: [TLS] FWD: First TLS cached information draft… Sean Shen