Re: [TLS] Review of draft-wouters-tls-oob-pubkey-00.txt

[Paul Wouters <[e-mail]>]

On Thu, 28 Jul 2011, Eric Rescorla wrote:

>> I'm interested in knowing why you consider it "clumsy". Especially because
>> it closely follows the RFC 6066 section 6 extension for supressing of
>> sending CA bundles with "trusted_ca_keys".  That apparent clumsiness
>> passed WGLC and IESG.
>
> What's clumsy is:
>
> (1) It's not generic, even though generic caching is useful.

1) It's generic for allowing an arbitrary authentication method outside PKIX, which
    generic caching does not, as it requires the TLS client to compute hashes over
    PKIX information. In fact, the TLS client has to lie about already having the CA
    bundle in order not to receive the PKIX blob.

2) generic caching is useful and it should also proceed through the IETF process.

> (2) It doesn't support bare keys when the client doesn't know the key, which
> is also useful, if you want to use bare keys at all. In fact, it
> doesn't even appear
> to support cases where the client knows only the key hash, which is common.

That is a use case I had not considered. It is not hard to add support for that.

> Whether it follows 6066 doesn't seem particularly relevant here, since we have a
> worked example of something better.

"something better" only works with your other assumption of "sending and signing
cruft in PKIX is fine". I strongly disagree with that.

Paul