Re: [TLS] draft-ietf-tls-oob-pubkey: The Open Issue

[Nikos Mavrogiannopoulos <[e-mail]>]

On 07/11/2012 12:56 PM, Hannes Tschofenig wrote:

> Hi all, 
> 
> draft-ietf-tls-oob-pubkey specifies a new TLS certificate type for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for use with out-of-band public key validation.
> 
> Here is the latest draft: 
> http://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-03
> 
> I would be great to get your feedback on an open issue that concerns the semantic of the exchange. I believe there are three use cases we would like to support with this work. Below, I provide high level message exchanges to explain those: 
> I) Server uses Raw Public Keys (client authentication happens at some other layer)


If you don't need a client certificate or public key, you don't send a
certificate request.

> II) Client and Server use Raw Public Keys
> (the smart object use case - CORE working group)


Your draft already covers that case.

> II) Hybrid Scenario

> (the OAuth Holder-of-the-Key Use case)

(server X.509 certificate, client raw public key)

I see two options. 1. You overload the ClientCertificateType of the
certificate request with a raw_rsa_sign that does what you intend. 2.
You create a new extension that modifies the format of the certificate
request to include an explicit certificate format.

regards,
Nikos