[TLS] Client Request and ecdsa

[TLS] Client Request and ecdsa_sign

"Mehner, Carl" <Carl.Mehner@usaa.com> Sat, 14 March 2015 05:43 UTC

From: "Mehner, Carl" <Carl.Mehner@usaa.com>
To: "tls@ietf.org" <tls@ietf.org>
Thread-Topic: Client Request and ecdsa_sign
Thread-Index: AdBeFxZAgbOQWepsTpeFtVwI35PnEA==
Date: Sat, 14 Mar 2015 05:43:12 +0000
Message-ID: <19075EB00EA7FE49AFF87E5818D673D41145EEAA@PRODEXMB01W.eagle.usaa.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/RsB3la_prLtEq7XPp4nd76pBz3k>
Subject: [TLS] Client Request and ecdsa_sign
Precedence: list

I created a new issue on GitHub:
https://github.com/tlswg/tls13-spec/issues/154


Right now it appears that ecdsa certificates are not allowed for use as client certificates. Should we explicitly state that they may be used in the Client Certificate section?


this would add an element (ecdsa_sign(64)) to the ClientCertificateType enum to make it:

enum {
           rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
           rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
           fortezza_dms_RESERVED(20), ecdsa_sign(64), (255)
       } ClientCertificateType;



as well as a new line to the certificate_types:

ecdsa_sign        a certificate containing an ECDSA key


I suppose we could add in the ecdsa_fixed_ecdh as well... but weren't we trying to go pure ephemeral?

If so, should we take out the other *_fixed_dh identifiers? Already the paragraph that starts, "For historical reasons," says those have been obsoleted.

[TLS] Client Request and ecdsa_sign Mehner, Carl
Re: [TLS] Client Request and ecdsa_sign Eric Rescorla