Content-Type: multipart/signed;
	boundary="Apple-Mail=_16C65516-B5FE-4CEA-8AF3-EBCE07957860";
	protocol="application/pgp-signature";
	micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81.1.4\))
From: Alan DeKok <alan.dekok@inkbridge.io>
In-Reply-To: 
 <CAH8yC8kCHDqaU5q6Ct8ZPCO+5cYJC+a+zEf8JD2Q7XZuYng7pQ@mail.gmail.com>
Date: Tue, 24 Mar 2026 09:25:42 +1300
Message-Id: <19C42BA1-8863-4E94-AB84-2AA7B8E96C59@inkbridge.io>
References: 
 <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
 <4732.1774288835@obiwan.sandelman.ca> <acGB3/g8HMNNOP4J@ubby>
 <DU0PR03MB86960694D96A2E52CCED6440864BA@DU0PR03MB8696.eurprd03.prod.outlook.com>
 <6952177E-8DC0-486E-980E-67CD5A0E1569@inkbridge.io>
 <CAH8yC8kCHDqaU5q6Ct8ZPCO+5cYJC+a+zEf8JD2Q7XZuYng7pQ@mail.gmail.com>
To: noloader@gmail.com
Message-ID-Hash: 2QH7LSJIKS2PPYL4UI2QTUQ3BZOVPCIM
CC: Tomas Gustavsson <Tomas.Gustavsson@keyfactor.com>,
 Michael Richardson <mcr+ietf@sandelman.ca>, Tls <tls@ietf.org>,
 "spasm@ietf.org" <spasm@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_=5Blamps=5D_TLS_Client_Certificates=3B_a_survey?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/D8TDAHK5kuW-W_lceNg_lDJDwcE>


--Apple-Mail=_16C65516-B5FE-4CEA-8AF3-EBCE07957860
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On Mar 24, 2026, at 8:18=E2=80=AFAM, Jeffrey Walton <noloader@gmail.com> =
wrote:
> Regarding Item (2), wouldn't Trust on First Use (TOFU) work well?

  Sure, for some definition of "work".  The traffic would be more secure =
than using raw TCP.

  But there are questions remaining.  Is the server you're connecting to =
actually owned by example.com <http://example.com/>?  Is it authorized?  =
etc.  We just don't know.

>   Remember, TLS is only intended to be about as secure as =
brick-and-mortar stores.  It is not intended to be as secure as Fort =
Knox.  The biggest threat in mail systems seems to be the mail operator =
reading your messages.  That's the insider threat in brick-and-mortar =
stores, where employees are committing an equal amount of the theft as =
external customers.
>=20
> And who needs a CA anyways?  All we need is a hostname and a public =
key.  We don't need a CA to bind them.  The hostname and public key =
information is presented in an end-entity certificate, so that's all we =
need.  The self-signed certificate can be hosted in DNS and retrieved as =
required since that seems to be the modern equivalent to the X.500 =
directory.  The world does not need to be adverse to self-signed =
certificates just because the CA/BF does not care for them.

  I find it a bit surprising that certificates can carry a substantial =
amount of information about purposes, authorization, hierarchies, etc.  =
But that pretty much the only way to make them usable is to just ignore =
all of that.

  Alan DeKok.


--Apple-Mail=_16C65516-B5FE-4CEA-8AF3-EBCE07957860
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmnBocYACgkQv3SJ0h7d
TTMa6w/8DyngT5q8Cp4/4UmdjQHTirb6V31k7vFkrFviKNdVf08YSMjXVmPDF3Ih
VNwsXFHyJqACSc+mpuI/+hL1LX8CakVxmpJk16zPA1aXZ4mcs0wuR3y/z6VUxcfL
67Lm53FJOezvugj5LRSEAXY1fYagj/aQa+leaCsEFYlmU3mvrWyaqaCK06wPDDsr
Wzg/3Foyv9wi0mmKdX+67xdd90cvPux939JUr847ph+NTKFgoYwxWP/OxjhqqJfn
sQtLvpnFrfOAbpVuDUsAVCoOsDOHhRpEev4f3WW77aXMVMrfDzwuAmBwJYUqO0cY
xBLjDwh8RMhpwh4bidp91XZE2232cmy89OZKjXbm/y6DVkR1SQYxJDXJXJjZJ8fy
7jP5qFbd4bKsyDNNXXU4kv9B48Kleq3Ohw6CfZi1furJK3Y87b2M+7HxdHBifHZ5
/Ma6fNLT4nlGsiNVFTCx+SUPKYaipC45xrMuZWhZfqN5Yt5b5vottalUf0FTbxCi
kvK0/KhZH97sOjZ0q31He0mp3P0156M2htFc7XGDN2eoT9EzRKDSJc7udnlFzp9Y
JhfX1sB6g2jP6ymJ8We0mL2StFFSo4A9RuwD9viBew2pk9GQgBTCfDaktbCku3cX
aVdgiHeZUZoNnEoskZpLa3RW817kaEuZGbglWl9UQBaqMLepbX8=
=kVOC
-----END PGP SIGNATURE-----

--Apple-Mail=_16C65516-B5FE-4CEA-8AF3-EBCE07957860--