IETF Logo Mail Archive

[TLS] Re: Dual certificates in TLS proposal

Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de> Thu, 19 June 2025 22:04 UTC

Return-Path: <muhammad_usama.sardar@tu-dresden.de>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 3F19E3722A11 for <tls@mail2.ietf.org>; Thu, 19 Jun 2025 15:04:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.398
X-Spam-Level:
X-Spam-Status: No, score=-4.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=tu-dresden.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nz1F9HYIoeqt for <tls@mail2.ietf.org>; Thu, 19 Jun 2025 15:04:30 -0700 (PDT)
Received: from mailout4.zih.tu-dresden.de (mailout4.zih.tu-dresden.de [141.30.67.75]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 6280D3722A01 for <tls@ietf.org>; Thu, 19 Jun 2025 15:04:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tu-dresden.de; s=dkim2022; h=Content-Type:In-Reply-To:From:References:CC:To :Subject:MIME-Version:Date:Message-ID:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=1bpsT9KLWmHyBFT0FAxi5umy4kHrTfrawDogTok0Xc0=; b=CQ3UuaVm3BXwamsUXAfcYSVs/B rRuQlq380e2eDIb5OZymtMygM9eNImDb9KfR/PazFn4UAJ4KqMi7+6A6D4Pk826AANW9KxYV1B7zu UMkMb8ZgTEEGr51CuEihtZoheKSAMoPeHK3OXryn4CVvmA5sYSQl3jZ53oX335hTn+HbwoM3OQrsY yG1URTV8Mju8uuhSAmpaYjafA7IZyCR9zWn91GQS6RxoYBbf5vo3txHkKzxxcStzQnLi8mZRd088c OoI5B+bUZ1Nsh7eMuTy1YcIDy3N2fHvRIv6tkfL3Pz0Y0w2mDZBMatxNjJcCJ3+vBALh2WvKMvFhH PHw3J+cg==;
Received: from msx-t422.msx.ad.zih.tu-dresden.de ([172.26.35.139] helo=msx.tu-dresden.de) by mailout4.zih.tu-dresden.de with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from <muhammad_usama.sardar@tu-dresden.de>) id 1uSNMy-00ELED-21; Fri, 20 Jun 2025 00:04:29 +0200
Received: from [172.18.5.64] (141.76.13.149) by msx-t422.msx.ad.zih.tu-dresden.de (172.26.35.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.26; Fri, 20 Jun 2025 00:04:22 +0200
Message-ID: <1760b19f-5bb8-4e90-a332-501582fe2351@tu-dresden.de>
Date: Fri, 20 Jun 2025 00:04:21 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Yaroslav Rosomakho <yrosomakho=40zscaler.com@dmarc.ietf.org>, tls@ietf.org
References: <CAMtubr1CHuJoiyG+t-kOfV4kcmV4XV7QmAYfLhK1saVL=f9MTQ@mail.gmail.com>
Content-Language: en-US
From: Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de>
In-Reply-To: <CAMtubr1CHuJoiyG+t-kOfV4kcmV4XV7QmAYfLhK1saVL=f9MTQ@mail.gmail.com>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-512"; boundary="------------ms030708030601080804080606"
X-ClientProxiedBy: MSX-L422.msx.ad.zih.tu-dresden.de (172.26.34.142) To msx-t422.msx.ad.zih.tu-dresden.de (172.26.35.139)
X-TUD-Virus-Scanned: mailout4.zih.tu-dresden.de
Message-ID-Hash: WG2TCHXM6LRSS53FQIMTTR46XM3IW5QX
X-Message-ID-Hash: WG2TCHXM6LRSS53FQIMTTR46XM3IW5QX
X-MailFrom: muhammad_usama.sardar@tu-dresden.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Hannes Tschofenig <Hannes.Tschofenig@gmx.net>, Mike Ounsworth <mike.ounsworth@entrust.com>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Dual certificates in TLS proposal
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/W7d4rfBCchQLMwpLLy21Lyl6G9k>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

I may be missing something from PQ side but I wonder what exactly is 
meant in Appendix B.5. For example, I have some trouble in precisely 
parsing the last sentence in B.5.1. Moreover, what is the difference 
between "identities" and "identifiers"? These terms are not even 
mentioned elsewhere in the draft.

More specifically, I was thinking about attested TLS. We proposed 
modification of CertificateVerify message as one of the potential 
solutions for attested TLS (slide 7/15 in [1]). In this case, one 
identifier is network identity and the other identifier is state of 
server (assuming server as Attester). Is Appendix B.5.1 meant to 
explicitly exclude such use cases of dual certificate in your design? If 
yes, why exactly? In order words, what design problem and/or extra work 
do you see in making it more generic for wider applications rather than 
limiting it to PQ/T?

Usama

[1] 
https://datatracker.ietf.org/meeting/122/materials/slides-122-tls-identity-crisis-00

v2.46.0 | Report a Bug | By Email | System Status