[TLS] 答复: Re: concers about draft-balfanz-tls-obc

[[e-mail]]

[e-mail] 写于 2011-11-18 17:19:21:

> On Fri, Nov 18, 2011 at 10:10 AM,  <[e-mail]> wrote:
> > Hi,
> >    I don't think the origin-bound-certificate is meaningful.
> >    The reasons are:
> >    1. CA signed client certificate is used to authenticate the client 
user,
> > now it is replaced by a self-signed certificate, how can a server 
trust or
> > authenticate a self confirmed user?
> 
> Isn't it the current situation in web sites? Aren't all popular web
> site's users self confirmed?

Not in the case of bank website.
the certificate may be signed by the bank but defntly not by the client 
user self.
> 
> >    2. If client authentication is not required, then there is neither 
need
> > to send a self-signed certificate.
> 
> I don't think that the draft asks for client to be authenticated when
> client authentication is not required.
> 
> >    3. To the goal of bindling cookie with self-signed certificate, the
> > ordinary CA signed certificates also work.
> 
> At a cost that no-one is willing to pay (not only monetary, but also
> the cost of proving yourself to the CA --or the CA will allow
> self-confirmation to the users? :).
> 
> regards,
> Nikos
> 



--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.