IETF Logo Mail Archive

Re: [TLS] draft-sullivan-tls-exported-authenticator-00

Andrei Popov <Andrei.Popov@microsoft.com> Tue, 01 November 2016 17:17 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8B6C1295AE for <tls@ietfa.amsl.com>; Tue, 1 Nov 2016 10:17:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.021
X-Spam-Level:
X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T55saHt7_vIM for <tls@ietfa.amsl.com>; Tue, 1 Nov 2016 10:17:45 -0700 (PDT)
Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0137.outbound.protection.outlook.com [104.47.32.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C247C12958D for <TLS@ietf.org>; Tue, 1 Nov 2016 10:17:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ebCjo1vuSqXq5v3YynJDA/1qn9JG7MuRNwTl4l0JqCs=; b=FGGIiUBeRasf/PLI+HqLvMgtpn6gaJ+ZBqBn8oN9ZOAbjvRafPQJyY2BR2XMCtEU2KvWMCjB0LxiFZPs9BWR9zIxNTjZLzcV8TBBM+ZBE2IRCEs30bKWMh93KWo9pMq9RjjZRDM+qfspKkd5Yc3uSkpRhip4ejZv0LUQ+agVKT0=
Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0834.namprd03.prod.outlook.com (10.160.154.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Tue, 1 Nov 2016 17:17:39 +0000
Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Tue, 1 Nov 2016 17:17:40 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: William Whyte <wwhyte@securityinnovation.com>, Nick Sullivan <nicholas.sullivan@gmail.com>
Thread-Topic: [TLS] draft-sullivan-tls-exported-authenticator-00
Thread-Index: AQHSM74CyYj9W0c/pkaJmajQ9ivOJ6DD0BAAgACP+HA=
Date: Tue, 01 Nov 2016 17:17:39 +0000
Message-ID: <BN3PR0301MB083670BEC8B1B0B40D532D8C8CA10@BN3PR0301MB0836.namprd03.prod.outlook.com>
References: <CAOjisRyWyON1FXghU09GTJYmvKpjgztFr_9wL=U6yV0-9DkcgA@mail.gmail.com> <CACz1E9qngj_726exoA4p57h63UaQB_JUokbaZ=fk1M2TF-JpXw@mail.gmail.com>
In-Reply-To: <CACz1E9qngj_726exoA4p57h63UaQB_JUokbaZ=fk1M2TF-JpXw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com;
x-originating-ip: [2001:4898:80e8::1d2]
x-ms-office365-filtering-correlation-id: a1240354-5abd-492d-8094-08d4027afbea
x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0834; 7:mXlZG33kU2a0ZE40AwbDAf9M8T0ifMs64efR8FcfQttvjOT382Hag/pWbUyrDwlEJjrDmfvi0Di9izk1/ZZDYMcqBygabUwhekLQxGdv7McbmoWLqlk1Y37hUo83MvCH/ettPUoW3/mJh44/2G6D5lUzpZf7eAsPEIaS0iNHXX3ccCEa+nQiJaV2/uKjjP119mrW3t7d+ES9gRo2rJvwoHb20SI3PLZlAU1CO5NdxWfyV4YR5UemxQlvdf3jhtFuZ/c4kGiOnyhDGVHpQbl4wS2l4qcrdQvMfRlFjn4mmp0P4Ppg4MoR9zY62MehMY/PP/cFb6odRbXoJOB4VBsddzk4o9U7T/UOZ7OD04SPOm8WimHxilTJI5Pug9CnhseH
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB0834;
x-microsoft-antispam-prvs: <BN3PR0301MB0834F24DA754A128202BB24B8CA10@BN3PR0301MB0834.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(60795455431006)(158342451672863)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040176)(6045074)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6046074)(6072074); SRVR:BN3PR0301MB0834; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0834;
x-forefront-prvs: 01136D2D90
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(24454002)(189002)(377454003)(199003)(97736004)(189998001)(230783001)(5002640100001)(76576001)(19617315012)(68736007)(10090500001)(3280700002)(3660700001)(87936001)(106356001)(105586002)(86362001)(99286002)(106116001)(5001770100001)(586003)(86612001)(19609705001)(8936002)(16236675004)(7846002)(561944003)(50986999)(54356999)(9686002)(122556002)(19300405004)(8990500004)(8676002)(7736002)(7906003)(33656002)(6116002)(102836003)(74316002)(5005710100001)(101416001)(19580405001)(81156014)(81166006)(790700001)(76176999)(19580395003)(10400500002)(19625215002)(77096005)(2900100001)(15975445007)(7696004)(5660300001)(92566002)(10290500002)(2950100002)(4326007)(2906002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0834; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB083670BEC8B1B0B40D532D8C8CA10BN3PR0301MB0836_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Nov 2016 17:17:39.7334 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0834
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/s8k7mMtxvJWtHbz8bFM04u3uJuM>
Cc: "tls@ietf.org" <TLS@ietf.org>
Subject: Re: [TLS] draft-sullivan-tls-exported-authenticator-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Nov 2016 17:17:48 -0000

Yes, this line has confused me as well.

Cheers,

Andrei

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of William Whyte
Sent: Tuesday, November 1, 2016 1:42 AM
To: Nick Sullivan <nicholas.sullivan@gmail.com>
Cc: tls@ietf.org
Subject: Re: [TLS] draft-sullivan-tls-exported-authenticator-00

I'm confused by the line "These messages are not encrypted", because on a plain reading it could mean that the authenticator is sent outside the encrypted TLS session. That would be bad because it would mean that clients that wanted to authenticate themselves but to the server only wouldn't be able to use this mechanism. I assume that's not the intent? If that isn't the intent, suggest rephrasing as "These messages are not encrypted, other than the encryption provided on transmission by the TLS session".

Cheers,

William

On Mon, Oct 31, 2016 at 5:29 PM, Nick Sullivan <nicholas.sullivan@gmail.com<mailto:nicholas.sullivan@gmail.com>> wrote:
<https://tools.ietf.org/html/<https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00>draft-sullivan-tls-exported-authenticator-00><https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00>
I just posted a new Internet-Draft called "Exported Authenticators in TLS" in the TLS working group.

The intent of this draft is to enable participants in a TLS connection to prove ownership of additional certificates. This differs from previous proposals (https://tools.ietf.org/html/draft-sullivan-tls-post-handshake-auth-00) in that these proofs are not sent as part of the TLS connection, but instead exported so that they can be sent out of band (as part of an application layer message, for example).

This proposal should enable a radical simplification of the Secondary Certificate Authentication in HTTP/2 proposal (https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-01), and should generally be a useful tool for binding a certificate ownership proof to a TLS connection.
Nick Sullivan

_______________________________________________
TLS mailing list
TLS@ietf.org<mailto:TLS@ietf.org>
https://www.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email