Re: [TLS] Call for acceptance on multi-stapling

[Kyle Hamilton <[e-mail]>]

On Wed, Apr 18, 2012 at 2:02 PM, Eric Rescorla <[e-mail]> wrote:
> WG members,
>
> At the meeting in Paris there was broad consensus to adopt Yngve's
> TLS Multi-Stapling draft
> (http://www.ietf.org/id/draft-pettersen-tls-ext-multiple-ocsp-03.txt).
>
> The WG chairs would like to confirm this consensus. Please send any
> comments by Wednesday April 25.

I believe that this is improper for TLS-WG to take up.  The problem
that multi-stapling is intended to address can be done completely
within an X.509 self-signed structure, and derives from PKIX-WG not
producing a single coherent standard that client protocols can simply
plug in.  Trying to work around a PKIX-WG problem in TLS is not going
to solve the same types of problems that exist in all other PKIX
client protocols.

If PKIX-WG could get its collective head out of its... darkness... I'd
say push this over there, and force them to come up with a real single
atomic credential format that can securely support asserting multiple
certificate chains, stapled OCSP responses for ALL certificates in ALL
chains, multiple timestamps... basically, TLS has one place to assert
one keypair.  All we need is a signature chain (or multiple signature
chains) to say that someone (an identified X.509 principal, not an
X.509 device) actually *gasp* used their own authority to assign a key
to a device.

That we can't do this is a bug in PKIX, not a bug in TLS.  That we
can't get multiple certificate status responses in a single structure
is a failure of PKIX, not TLS.  Working around it in TLS-WG is
inefficient, and will not solve the same problem in other PKIX client
protocols.

Unfortunately, because PKIX-WG can't/won't do anything because
everybody's too afraid of changing the status quo, this seems to be
the only effective option that presents.  I would prefer that it not
be handled here, but since the problem in PKIX (which won't change) is
exposed by TLS...

I (grudgingly) shall support this, with many reservations.

-Kyle H