Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft posted

[Adam Langley <[e-mail]>]

On Thu, Feb 18, 2010 at 11:31 AM, Adam Langley <[e-mail]> wrote:
> 1) makes the extension symmetrical and it seems like there might be
> something in the future that the server would like to predict from the
> client. At the moment we suggest that the server might want to support
> predicting the client's certificate. Often a CertificateRequest
> handshake is a renegotiation and a higher level knows what certificate
> the client should be presenting.

wtc pointed out to me that this might be unclear. The situation that I
have in mind is this:

A user is using HTTPS to navigate a web site and reaches a point where
they need to authenticate. They enter their username in a text field
and hit "Login using certificate". This triggers a renegotiation with
a CertificateRequest and, at this point, the server knows the
certificate that the client should be presenting. The client could
even use this to guide the user in the selection of the certificate.

People might feel that this is a little contrived and I wouldn't mind
in the slightest if it was dropped. But it seems simpler that the
extension should be symmetrical and odd to assume that we'll never
need to predict anything from the client.


Cheers

AGL