Re: [Trans] [trans] #74 (rfc6962-bis): normative statement of TLS client behavior in Section 3

On 6 July 2015 at 15:50, Stephen Kent <kent@bbn.com> wrote:
> I note the following text from the -07 draft that appear to specify TLS
> client behavior:
>
> Section 1
>
>    TLS clients can thus require that all certificates they accept as valid
> have been logged.

This doesn't specify anything, just notes that clients can do it (if
they want to, obviously).

>
> Section 3
>
>    A certificate not
>    accompanied by an SCT (either for the end-entity certificate or for a
>    name-constrained intermediate the end-entity certificate chains to)
>    MUST NOT be considered compliant by TLS clients.

Again, no behaviour is specified. The client is required to understand
that the cert is not in conformance with CT. It can do what it wants
with that understanding.

>
>
> Section 3.4
>
>    TLS clients MUST implement all three mechanisms.

What we ruled out of scope is how clients behave in terms of user
interface, et al. Clearly a protocol document has to describe how the
protocol works. That is not the kind of behaviour we ruled out.

>
>
> Section 3.4.1
>
>    TLS clients that support the extension SHOULD send a ClientHello
>    extension with the appropriate type and empty "extension_data".
>
>    TLS clients
>    SHOULD include the extension type in the ClientHello, but if the
>    session is resumed, the TLS server is not expected to process it or
>    include the extension in the ServerHello.

See above.

>
>
> Section 5.3
>
>
>    In addition to normal validation of the certificate and its chain, TLS
>    clients SHOULD validate the SCT by computing the signature input from
>    the SCT data as well as the certificate and verifying the signature,
>    using the corresponding log's public key.

And again.

>
>
> #74: normative statement of TLS client behavior in Section 3
>
>
> Comment (by benl@google.com):
>
>  Describing how the protocol works from the client's POV is _not_ about
>  client behaviour, it is about the client's understanding of the situation.
>  How it behaves as a result of that understanding is behaviour.
>
>  I propose this should be closed "wontfix".
>
>
>
> _______________________________________________
> Trans mailing list
> Trans@ietf.org
> https://www.ietf.org/mailman/listinfo/trans
>