Subject: [quicwg/base-drafts] Clarify why post-handshake client auth is banned (#3044)

From: David Schinazi <[email-masked]>
Date: Mon, 16 Sep 2019 23:11:51 -0700

Add short explanation and reference to explain why QUIC-TLS bans the use of post-handshake client authentidaction.

Fixes #2367.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3044

-- Commit Summary --

  * Clarify why post-handshake client auth is banned

-- File Changes --

    M draft-ietf-quic-tls.md (9)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3044.patch
https://github.com/quicwg/base-drafts/pull/3044.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044

---

From: Marten Seemann <[email-masked]>
Date: Mon, 16 Sep 2019 23:27:30 -0700

marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044#pullrequestreview-289041189

---

From: Martin Thomson <[email-masked]>
Date: Tue, 17 Sep 2019 00:48:27 -0700

martinthomson approved this pull request.

I'm going to say that this is editorial-enough to just merge.  MUST NOT implies PROTOCOL_VIOLATION, so the new normative language is fine as editorial.  I'll give others a chance to disagree though.

> @@ -612,8 +612,13 @@ MAY refuse a connection if the client is unable to authenticate when requested.
 The requirements for client authentication vary based on application protocol
 and deployment.
 
-A server MUST NOT use post-handshake client authentication (see Section 4.6.2 of
-{{!TLS13}}).
+A server MUST NOT use post-handshake client authentication (as defined in
+Section 4.6.2 of {{!TLS13}}), because the multiplexing offered by QUIC prevents
+clients from correlating the certificate request with the application-level
+event which triggered it (see {{?HTTP2-TLS13=I-D.ietf-httpbis-http2-tls13}}).

CMOY (cite my own work) alert.  :)

Also a CMOS tweak (Chicago Manual of Style) tweak:
```suggestion
event that triggered it (see {{?HTTP2-TLS13=I-D.ietf-httpbis-http2-tls13}}).
```

> @@ -612,8 +612,13 @@ MAY refuse a connection if the client is unable to authenticate when requested.
 The requirements for client authentication vary based on application protocol
 and deployment.
 
-A server MUST NOT use post-handshake client authentication (see Section 4.6.2 of
-{{!TLS13}}).
+A server MUST NOT use post-handshake client authentication (as defined in
+Section 4.6.2 of {{!TLS13}}), because the multiplexing offered by QUIC prevents
+clients from correlating the certificate request with the application-level
+event which triggered it (see {{?HTTP2-TLS13=I-D.ietf-httpbis-http2-tls13}}).
+More specifically, servers MUST NOT send post-handshake TLS CertificateRequest
+messages, and clients MUST treat receipt of such messages as a connection error

```suggestion
messages and clients MUST treat receipt of such messages as a connection error
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044#pullrequestreview-289075027

---

From: David Schinazi <[email-masked]>
Date: Tue, 17 Sep 2019 01:27:45 -0700

@DavidSchinazi pushed 1 commit.

06486475d04ecb979e5c8545df4b84fcd89b5016  MT editorial pass

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044/files/751aef9c80307a9b61f6bae887566eb9a9e3b766..06486475d04ecb979e5c8545df4b84fcd89b5016

---

From: David Schinazi <[email-masked]>
Date: Tue, 17 Sep 2019 01:28:16 -0700

DavidSchinazi commented on this pull request.

I'm honored to have been confused with @davidben.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044#discussion_r325040966

---

From: David Benjamin <[email-masked]>
Date: Tue, 17 Sep 2019 11:14:12 -0700

davidben commented on this pull request.

Likewise. :-)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3044#discussion_r325314195