[TLS] concers about draft-balfanz-tls-obc

[[e-mail]]

Hi,
   I don't think the origin-bound-certificate is meaningful.
   The reasons are:
   1. CA signed client certificate is used to authenticate the client 
user, now it is replaced by a self-signed certificate, how can a server 
trust or authenticate a self confirmed user?
   2. If client authentication is not required, then there is neither need 
to send a self-signed certificate.
   3. To the goal of bindling cookie with self-signed certificate, the 
ordinary CA signed certificates also work.


Sujing Zhou

--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.