IETF Logo Mail Archive

Re: [TLS] X509 extension to specify use for only one origin?

Henry Story <henry.story@bblfish.net> Wed, 09 March 2016 16:14 UTC

Return-Path: <henry.story@bblfish.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAEB612D6B9 for <tls@ietfa.amsl.com>; Wed, 9 Mar 2016 08:14:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=bblfish-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RkzDMYHkwB5M for <tls@ietfa.amsl.com>; Wed, 9 Mar 2016 08:14:24 -0800 (PST)
Received: from mail-wm0-x229.google.com (mail-wm0-x229.google.com [IPv6:2a00:1450:400c:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAFD612E0DC for <tls@ietf.org>; Wed, 9 Mar 2016 08:08:08 -0800 (PST)
Received: by mail-wm0-x229.google.com with SMTP id p65so77720420wmp.0 for <tls@ietf.org>; Wed, 09 Mar 2016 08:08:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bblfish-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=BR0y9OxcX1SJLX/qiJ/k8mDDJ6hxlkDU9N5oi9EpcMM=; b=2E/sUDjduxt9vOUETtHyrLigBG1P8LQD5q9yf/vsikZW7MPcrSozkB6M5LMcOZHvdr pNNK1FspmgZf5q8XounrSktr6xhOFwBj4LbANhLJ4yLJJJUrcn/qljz0eRHmkHiJgh/b /JDBF7Y3GpaMY/dC7v5+i87CSrjkcgwGImL55RVpKvZH4Pea2Zyq6wv08LTe3RJAZLE2 y5u7GWxZLdRK9u26+oWtrZ2ZR9jLsPK/uIX5sOSw1ZS+JtDreCZNgW/RX5aMBe46HwEd OJD0YJaBsdCTb4Syjqb0Lseqi53AbZ22PUPk9NQjJGQtYHkTosMFqdOJYSTha4UqAMjl FmEw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=BR0y9OxcX1SJLX/qiJ/k8mDDJ6hxlkDU9N5oi9EpcMM=; b=mSrt9Mp/yvXonweCYprOEh4p3/16xZO9JeIgpEHqg1wFmPbneN82a5yJeVMONbhSUu 5T1RFkVqRHmqRQCYIofiKWjz5LhnAeL42l4PEoDKDNRRvPyDaDkbgI5qg9b92SX0hWnv KuDGq19wx5bgyBNJN4pPKXc6r1aeBeYTlqsGkShodExekrSZXyaV2V3EqkZM2UE6LgVx 64b1k1hp4SQEDDcY4zO5/eMEBhMvSSB9GfEPpisX0yVlCp+TdUvGJKnTNImy3Tb3qGlC 18phnXyu5YG+IMKV+yHp5wSsJ8uwIkL3QB8vhGRodtvTxxmr4Lj9qBB88sWvlcvqpa4A HtYQ==
X-Gm-Message-State: AD7BkJLpbdNMwtn3GnDuduo1zpum0yzkwZE7WsB1npSSKsaFush+Ca+w3A1qV/0ZJUH/zA==
X-Received: by 10.194.76.161 with SMTP id l1mr35845019wjw.108.1457539687448; Wed, 09 Mar 2016 08:08:07 -0800 (PST)
Received: from [192.168.0.6] (cpc2-popl3-2-0-cust563.13-2.cable.virginm.net. [86.21.242.52]) by smtp.gmail.com with ESMTPSA id i5sm8564400wja.23.2016.03.09.08.08.05 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 09 Mar 2016 08:08:05 -0800 (PST)
Content-Type: multipart/alternative; boundary="Apple-Mail=_4536DA63-4436-4DBB-A764-DEB58B3C0F7D"
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
From: Henry Story <henry.story@bblfish.net>
In-Reply-To: <CABcZeBN4zaencMb=TKuB4Qk3B2b09D7Vv=XR2LZvSDRLwng0pw@mail.gmail.com>
Date: Wed, 09 Mar 2016 16:08:28 +0000
Message-Id: <7656CF21-B80B-4378-8248-80F4A596151E@bblfish.net>
References: <E52FE3EA-AC0A-4CEA-885F-E6558889170F@bblfish.net> <CABcZeBN4zaencMb=TKuB4Qk3B2b09D7Vv=XR2LZvSDRLwng0pw@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
X-Mailer: Apple Mail (2.3112)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/y3uKMjTmOAjEfRanPguQHg12U4g>
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] X509 extension to specify use for only one origin?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Mar 2016 16:14:26 -0000

> On 9 Mar 2016, at 16:01, Eric Rescorla <ekr@rtfm.com> wrote:
> 
> This is not a TLS WG issue.

Where should I go to post this question? Sorry I don't know the full ecosystem.

Henry

> 
> -Ekr
> 
> 
> On Wed, Mar 9, 2016 at 6:36 AM, Henry Story <henry.story@bblfish.net <mailto:henry.story@bblfish.net>> wrote:
> Hi,
> 
>   The W3C TAG is working on a finding for Client Certificates that
> people here should find very interesting [1].
> 
> One issue that comes up a lot in discussions is the use of certificates
> across origins [2], which some folks find problematic, even though it
> clearly has its uses [3].
> 
>  It seems that this could be solved neatly with an X509 extension
> limiting usage to a certain origin or set of origins. I would not
> be surprised if this already exists. With browser chrome support this
> would allow the full range of uses from FIDO to cross origin ones
> whilst putting the user in control.
> 
> Henry
> 
> 
> [1] https://github.com/w3ctag/client-certificates <https://github.com/w3ctag/client-certificates>
> [2] https://github.com/w3ctag/client-certificates/issues/1 <https://github.com/w3ctag/client-certificates/issues/1>
> [3] https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303 <https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org <mailto:TLS@ietf.org>
> https://www.ietf.org/mailman/listinfo/tls <https://www.ietf.org/mailman/listinfo/tls>
>

v2.23.0 | Report a Bug | By Email