Re: [TLS] TLS Proxy Server Extension

[Marsh Ray <[e-mail]>]

On 08/01/2011 10:08 AM, Yoav Nir wrote:
>
> I'm also thinking about whether we can get client certificates to work.
> The hard problem is that Certificate Verify signs the handshake messages,
> and those are not available to the client. I don't think we want to send
> all the previous handshake messages in the extension, so getting this to
> work would also require a server-side change.

You could just send the MD5/SHA-1/SHA-256 hashes of the messages, which 
is what the client cert signs.

Of course, this amounts to the client being willing to sign basically 
anything for the proxy, carte blanche. If the client's cert were valid 
for other things such as serving TLS or code signing that could 
represent a significant escalation of privilege.

- Marsh