IETF Logo Mail Archive

Re: [TLS] Comments on TLS identity protection

Martin Rex <martin.rex@sap.com> Tue, 19 December 2006 21:15 UTC

Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1GwmIp-00045u-1N; Tue, 19 Dec 2006 16:15:11 -0500
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1GwmIn-000457-BR for tls@ietf.org; Tue, 19 Dec 2006 16:15:09 -0500
Received: from smtpde02.sap-ag.de ([155.56.68.170]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1GwmIl-0005UK-VW for tls@ietf.org; Tue, 19 Dec 2006 16:15:09 -0500
Received: from sap-ag.de (smtpde02) by smtpde02.sap-ag.de (out) with ESMTP id WAA02921; Tue, 19 Dec 2006 22:15:02 +0100 (MEZ)
From: Martin Rex <martin.rex@sap.com>
Message-Id: <200612192115.WAA22812@uw1048.wdf.sap.corp>
Subject: Re: [TLS] Comments on TLS identity protection
To: ekr@networkresonance.com
Date: Tue, 19 Dec 2006 22:15:01 +0100
In-Reply-To: <86vek7pph4.fsf@raman.networkresonance.com> from "Eric Rescorla" at Dec 19, 6 01:04:07 pm
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-SAP: out
X-SAP: out
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f
Cc: tls@ietf.org
X-BeenThere: tls@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: martin.rex@sap.com
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/tls>
List-Post: <mailto:tls@lists.ietf.org>
List-Help: <mailto:tls-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=subscribe>
Errors-To: tls-bounces@lists.ietf.org

Eric Rescorla wrote:
> 
> Good point. 
> 
> However, as you say in most cases the request for client auth
> is contingent upon seeing the request and so a rehandshake is
> required here in any case. A one-pass protocol wouldn't work
> here.

Correct.

I had the same thought but completely failed to point this out.

In the not uncommon case with IIS renegotiating after having
evaluated the HTTP(S)-request, the one-pass protocol can not
be used.

-Martin

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email