Re: [TLS] TLS, PKI,

[Peter Gutmann <[e-mail]>]

Kyle Hamilton <[e-mail]> writes:
>TLS has several modes which are unsupported by the members of this list:
>
>1) A supported (by the standard) mode of "unauthenticated TLS" (neither
>the server nor the client offer or demand certificates).
>2) Mutual Authentication -- it's supported by this group in the
>protocol, *except* that very few clients who actually have certificates
>typically don't have the marketing acumen to show just why they might be
>useful.
>3) The classic "server authenticates, client doesn't" issue 

Just to be pedantic, what you're describing in (2) isn't mutual authentication 
but unilateral authentication in both directions, which is just as phishable 
as (3) is.  Real mutual authentication is TLS-PSK and TLS-PSK.

>X.509:08/2005 is 174 pages long, including 39 pages of text that is not
>characterized as being contained within any RFC ('non-normative annexes'
>and the roman-numeral pages at the beginning, a blank page, and the
>title page).  That's 135 pages of actual normative content.
>
>RFC 5280, on the other hand, is 152 pages.  This means... THE NORMATIVE
>INTERNET PROFILE FOR X.509 IS LARGER THAN NORMATIVE X.509 ITSELF.  This
>is as close to 'insane' as I can find myself thinking about standards
>bodies (in this case, the PKIX WG).

Not only that, but the PKIX standing committee has so far produced one 
thousand seven hundred pages of PKI standards with a further five hundred 
pages of additional draft standards waiting in the wings. Just to put that 
into perspective, this means that one single PKI committee's standards and 
drafts are more than twice as voluminous as all three volumes of Stevens' 
TCP/IP Illustrated, which covers not only all of the core protocols used on 
the Internet (in far more detail than the RFCs do) but contains a complete 
implementation of a TCP/IP protocol stack to boot.

(I'm sure there's some sort of standardisation variant of "a country was never 
taxed into prosperity" lurking in there, but the few variants I can think of 
don't sound like much).

Peter.