Re: [TLS] RFC 5878 - why?

[Russ Housley <[e-mail]>]

> Hi,
> 
> Does anyone know of a reason to use RFC 5878?  Extension data can
> already be sent in TLS handshakes:
> 
> Client -> Server : ClientHello Extension
> Client <- Server : ServerHello Extension
> Client -> Server : SupplementalData (RFC 4680)
> 
> 
> 5878 just adds another extension structure inside existing ones:
> 
> Client -> Server : ClientHello Extension signalling AuthorizationData
> Client <- Server : ServerHello Extension signalling AuthorizationData,
>                            SupplementalData containing AuthorizationData
> Client -> Server : SupplementalData containing AuthorizationData
> 
> 
> Seems like a bunch of added parsing for nothing?  What is this for?
> 
> 
> Trevor

As far as I know, my co-author is the only one that implemented the specification.  It worked.  However, he has changed jobs, and I do not think he is working on it any more.

Over the years, we have answered several queries from other people that were looking for an authorization mechanism.  I do not know if they used this approach or not.

As to the complexity, you should take a look at the TLS mail list discussion about TLS User Mapping Extension, which became RFC 4681.  Both user mapping and authorization were forced into the SupplementalData structure.  Both had more straightforward approaches in the beginning.

Russ