Re: [TLS] Last Call: <draft-ietf-tls-oob-pubkey-09.txt> (Out-of-Band Public Key Validation for Transport Layer Security (TLS)) to Proposed Standard

Alexey Melnikov <> Thu, 08 August 2013 15:26 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8348111E8132; Thu, 8 Aug 2013 08:26:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -101.776
X-Spam-Status: No, score=-101.776 tagged_above=-999 required=5 tests=[AWL=0.824, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EOc09VmXuFz0; Thu, 8 Aug 2013 08:26:48 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 51D0C11E814C; Thu, 8 Aug 2013 08:26:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1375975607;; s=selector;; bh=TwASpAMHgbRb/efhcyU0hoR/qAsNrA/hDcbn97XbcDk=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=dGsMd30XxnVnmdoE+/YsZZKk6PQpRdCwG5h+/at+DacCMecQ5Pk6+/hfS5E+jqdttn6Fb6 CDTpt0xzqVKPNEz6BmiLWHvNapgUzeUmm4LpAnlKQ1qoNoqzblosni5+02oZb8zrjMV17Y zjDQF50ilBBiC3Fb/xl3mvOXvVJJsb4=;
Received: from [] ( []) by (submission channel) via TCP with ESMTPA id <>; Thu, 8 Aug 2013 16:26:46 +0100
Message-ID: <>
Date: Thu, 08 Aug 2013 16:26:52 +0100
From: Alexey Melnikov <>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20130620 Thunderbird/17.0.7
References: <>
In-Reply-To: <>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [TLS] Last Call: <draft-ietf-tls-oob-pubkey-09.txt> (Out-of-Band Public Key Validation for Transport Layer Security (TLS)) to Proposed Standard
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 08 Aug 2013 15:26:53 -0000

On 02/08/2013 08:23, The IESG wrote:
> The IESG has received a request from the Transport Layer Security WG
> (tls) to consider the following document:
> - 'Out-of-Band Public Key Validation for Transport Layer Security (TLS)'
>    <draft-ietf-tls-oob-pubkey-09.txt> as Proposed Standard
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> mailing lists by 2013-08-16. Exceptionally, comments may be
> sent to instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
> Abstract
>     This document specifies a new certificate type and two TLS
>     extensions, one for the client and one for the server, for exchanging
>     raw public keys in Transport Layer Security (TLS) and Datagram
>     Transport Layer Security (DTLS) for use with out-of-band public key
>     validation.
I just read the document and support its publication.

I think I found one minor issue:

Section 4.1 says:

    In order to indicate the support of out-of-band raw public keys,
    clients MUST include the 'client_certificate_type' and
    'server_certificate_type' extensions in an extended client hello
    message.  The hello extension mechanism is described in TLS 1.2

In Section 5 (the first example):

    server_certificate_type=(RawPublicKey) -> // [1]

So it looks like the example doesn't comply with the MUST requirement in 
the Section 4.1 ("client_certificate_type" is missing) or the 
requirement stated in Section 4.1 is incorrect. I suspect you meant 
"'client_certificate_type' and/or 'server_certificate_type'" in Section 4.1.

Best Regards,