Re: [TLS] Fwd: AUTH48 [AR]: RFC 7250 <draft-ietf-tls-oob-pubkey-11.txt> changes

[Viktor Dukhovni <[e-mail]>]

On Tue, May 27, 2014 at 05:24:09PM +0000, Joseph Salowey (jsalowey) wrote:

> > Section 4.3:
> > 
> > OLD:
> >   Authentication of the TLS client to the TLS server is supported only
> >   through authentication of the received client SubjectPublicKeyInfo
> >   via an out-of-band method.
> > 
> > NEW:
> > 
> >   When the TLS server has specified RawPublicKey as the
> >   client_certificate_type, authentication of the TLS client to the
> >   TLS server is supported only through authentication of the received
> >   client SubjectPublicKeyInfo via an out-of-band method.
> > 
> > [...]
> > 
> > Add Section 4.4.  Server Authentication
> > 
> > NEW:
> >   When the TLS server has specified RawPublicKey as the
> >   server_certificate_type, authentication of the TLS server to the
> >   TLS client is supported only through authentication of the received
> >   client SubjectPublicKeyInfo via an out-of-band method.

Some (as I did briefly, though I think I have finally figured out
what is meant) might find "authentication" here a bit confusing.

There are two parts to the traditional use of a public key in TLS for
authentication:

    * The public key is used to sign the key exchange or decrypt
      key transport.  This proves that the counter-party possesses
      the corresponding private key.

    * The public key is delivered in the form of a certificate that
      attests to a binding between the public key and some identity.

When I first read the quoted text out of context, I though it was
saying that both parts were out of band, which is surely not the
case.  Rather it is merely the identity mapping that is out of
band, each side still verifies possession via appropriate signatures.

Is the use of raw public keys to sign the relevant bits of the
handshake that would otherwise have been signed by the public key
embedded in the certificate too obvious to have to state explicitly?

-- 
	Viktor.