Re: [TLS] RFC-4366-bis and the unrecognized_name(112) alert

[Nikos Mavrogiannopoulos <[e-mail]>]

Michael D'Errico wrote:

> There is never a clear line you can draw between one layer and another,
> such that no TLS layer will ever reach higher toward an application, or
> that no application will reach lower toward the TLS layer.
> 
> In my TLS code, there is a simple configuration scheme that applications
> use to tell the TLS layer which domain names map to which certificate
> chains.  Once set up, the application doesn't need to do anything more
> since the TLS code then handles certificate selection based on the SNI,
> version, cipher suite, supported signature algorithms, and key usage.
> It's quite complicated.
> 
> You might condemn this as some sort of layering violation, but it really
> does make life easier for application writers.  I wrote the code once
> instead of requiring every application writer to have to reinvent it.

Note that he's talking about the protocol not about a specific
implementation. A library could handle everything over all layers or
only handle few things on a layer. It is just an implementation for a
specific purpose. It is perfectly ok to see network implementations
mixing tcp/ip and dns resolving, even TLS, although they are not
strictly in a single layer.

However layers should be clear in the protocol descriptions to allow for
replacing layers transparently. TLS does not need DNS to work, nor
TCP/IP. If the new internet runs on BBP/CD, TLS will still work.

regards,
Nikos