Re: [TLS] AUTH48 [AR]: RFC 7250 <draft-ietf-tls-oob-pubkey-11.txt> changes

On May 27, 2014, at 11:10 AM, Viktor Dukhovni <viktor1dane@dukhovni.org> wrote:

> On Tue, May 27, 2014 at 05:24:09PM +0000, Joseph Salowey (jsalowey) wrote:
> 
>>> Section 4.3:
>>> 
>>> OLD:
>>>  Authentication of the TLS client to the TLS server is supported only
>>>  through authentication of the received client SubjectPublicKeyInfo
>>>  via an out-of-band method.
>>> 
>>> NEW:
>>> 
>>>  When the TLS server has specified RawPublicKey as the
>>>  client_certificate_type, authentication of the TLS client to the
>>>  TLS server is supported only through authentication of the received
>>>  client SubjectPublicKeyInfo via an out-of-band method.
>>> 
>>> [...]
>>> 
>>> Add Section 4.4.  Server Authentication
>>> 
>>> NEW:
>>>  When the TLS server has specified RawPublicKey as the
>>>  server_certificate_type, authentication of the TLS server to the
>>>  TLS client is supported only through authentication of the received
>>>  client SubjectPublicKeyInfo via an out-of-band method.
> 
> Some (as I did briefly, though I think I have finally figured out
> what is meant) might find "authentication" here a bit confusing.
> 
> There are two parts to the traditional use of a public key in TLS for
> authentication:
> 
>    * The public key is used to sign the key exchange or decrypt
>      key transport.  This proves that the counter-party possesses
>      the corresponding private key.
> 
>    * The public key is delivered in the form of a certificate that
>      attests to a binding between the public key and some identity.
> 
> When I first read the quoted text out of context, I though it was
> saying that both parts were out of band, which is surely not the
> case.  Rather it is merely the identity mapping that is out of
> band, each side still verifies possession via appropriate signatures.
> 

[Joe] This is the correct interpretation.  

> Is the use of raw public keys to sign the relevant bits of the
> handshake that would otherwise have been signed by the public key
> embedded in the certificate too obvious to have to state explicitly?
> 

[Joe] I think so, this is core to TLS operation.  I'm not confident that I can come up with text that would be less confusing.   Do you have any suggested modifications?  I think we will probably leave the text as is, but I can pass on a suggestion if you have one.  

> -- 
> 	Viktor.
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls