Re: [TLS] X509 extension to specify use for only one origin?

Eric Rescorla <ekr@rtfm.com> Wed, 09 March 2016 16:15 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E03FB12D61E for <tls@ietfa.amsl.com>; Wed, 9 Mar 2016 08:15:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MVd4cwocClJs for <tls@ietfa.amsl.com>; Wed, 9 Mar 2016 08:15:46 -0800 (PST)
Received: from mail-yk0-x22b.google.com (mail-yk0-x22b.google.com [IPv6:2607:f8b0:4002:c07::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67CB312DE4D for <tls@ietf.org>; Wed, 9 Mar 2016 08:10:25 -0800 (PST)
Received: by mail-yk0-x22b.google.com with SMTP id z7so22641218yka.0 for <tls@ietf.org>; Wed, 09 Mar 2016 08:10:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Cqb3AnR2q4bdLNUvCB9diPWHUF7r8wnpxzft3+xpAS0=; b=B6BtI97eQKGD040hZCv2WfSw/qPVfX53vjPw2EJ+86fooidweECKP4kaaU6mvh7YVd rxgyEfgtEOtmJwb4ON7WYYoPaw0gIaCtWrds5lJ2rpa9BQMNp3rlVeESiCBr1TtQgo+1 tgEvmK5E7kolxTME0vxlvSd1b8VZ4JJGQDm57diZdzdSVFspw/RM0YQzODCZIIOXVR5o CUTq9C3DXwrfkXwXw3qHv8lqY3W6xqUvbhGJmjZbe1/OulaeG5Nd8FlwFwjKoeTnpqb+ SXAWwEWrwCLYushoj+SOp0x8Fht8/MFgIvRyyB9hcTQahw9ygFKoYqO5UdQVtz3dEmhX 7HPQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Cqb3AnR2q4bdLNUvCB9diPWHUF7r8wnpxzft3+xpAS0=; b=l/AXkOt2MxXD9PkTEd217NbQzyQGauAFn28Aub578Yg5g61BhmqES4INY33i76y/7z SDC+MIB9WX6OuQsTUx49Ov6c/mZ5nCDGFkPolbg7AJOlYBa3R/OtqXX82xzPV54MDTCK VYq0tF5vQyTnSboxC4T4RH5PDRBQ2/l60u7fRTC8Q1UGDUSJaQ3ANOXmYklisKGmXh4E PiPqrNSaOO6nd5GPpQ53JAwVKdseYEOPsf8hvCSUAI2cblGPNMImJHSbbw8zW/ruIqZh CtJIO+SOEk7x18mZhulyefmyns2yBYZsnrHdAjMuo0oggfpSF3codn6Gzhl2fY0WPCxE 42dg==
X-Gm-Message-State: AD7BkJJ9p+w0KK4UHCt9NUayBPrUESlNmAUCEGkUH3BCMC/a295SLlkMrc9Yp6JAb9wBSDJw7bjXOsuiv3MUug==
X-Received: by 10.37.89.134 with SMTP id n128mr11416863ybb.162.1457539821878; Wed, 09 Mar 2016 08:10:21 -0800 (PST)
MIME-Version: 1.0
Received: by 10.13.249.5 with HTTP; Wed, 9 Mar 2016 08:09:42 -0800 (PST)
In-Reply-To: <7656CF21-B80B-4378-8248-80F4A596151E@bblfish.net>
References: <E52FE3EA-AC0A-4CEA-885F-E6558889170F@bblfish.net> <CABcZeBN4zaencMb=TKuB4Qk3B2b09D7Vv=XR2LZvSDRLwng0pw@mail.gmail.com> <7656CF21-B80B-4378-8248-80F4A596151E@bblfish.net>
From: Eric Rescorla <ekr@rtfm.com>
Date: Wed, 9 Mar 2016 08:09:42 -0800
Message-ID: <CABcZeBMGFWaDDPqnzjPRxmYAdyaX_yh+xe5nhpfM2gCpbUn7_Q@mail.gmail.com>
To: Henry Story <henry.story@bblfish.net>
Content-Type: multipart/alternative; boundary=001a1140f0e2547b47052d9fef96
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/vk4Asf2t7sHe2Da7YrdXzqBDShs>
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] X509 extension to specify use for only one origin?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Mar 2016 16:15:49 -0000

Not sure who is managing certs now that PKIX is closed. Try SAAG.

-Ekr


On Wed, Mar 9, 2016 at 8:08 AM, Henry Story <henry.story@bblfish.net> wrote:

>
> On 9 Mar 2016, at 16:01, Eric Rescorla <ekr@rtfm.com> wrote:
>
> This is not a TLS WG issue.
>
>
> Where should I go to post this question? Sorry I don't know the full
> ecosystem.
>
> Henry
>
>
> -Ekr
>
>
> On Wed, Mar 9, 2016 at 6:36 AM, Henry Story <henry.story@bblfish.net>
> wrote:
>
>> Hi,
>>
>>   The W3C TAG is working on a finding for Client Certificates that
>> people here should find very interesting [1].
>>
>> One issue that comes up a lot in discussions is the use of certificates
>> across origins [2], which some folks find problematic, even though it
>> clearly has its uses [3].
>>
>>  It seems that this could be solved neatly with an X509 extension
>> limiting usage to a certain origin or set of origins. I would not
>> be surprised if this already exists. With browser chrome support this
>> would allow the full range of uses from FIDO to cross origin ones
>> whilst putting the user in control.
>>
>> Henry
>>
>>
>> [1] https://github.com/w3ctag/client-certificates
>> [2] https://github.com/w3ctag/client-certificates/issues/1
>> [3]
>> https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
>
>
>