Subject: [quicwg/base-drafts] Ben Kaduk's TLS Comment 8 (#4484)

From: Lucas Pardue <[email-masked]>
Date: Tue, 05 Jan 2021 18:51:37 -0800

@kaduk said:

> Section 4.4
> 
>    A client MUST authenticate the identity of the server.  This
>    typically involves verification that the identity of the server is
>    included in a certificate and that the certificate is issued by a
>    trusted entity (see for example [RFC2818]).
> 
> I assume that, per normal TLS semantics, this requirement can be met by
> PSK authentication as well as certificate authentication.  PSK
> authentication has often been an aspect of TLS that has not received
> substantial attention, so we may want to preemtively pay some attention
> to the PSK case.
> 
>    A server MUST NOT use post-handshake client authentication (as
>    defined in Section 4.6.2 of [TLS13]), because the multiplexing
> 
> Do we want to say anything about not sending the "post_handshake_auth"
> extension (defined in the numerologically similar section 4.2.6 of RFC
> 8446)?  Strictly speaking we don't need to say anything, but efficient
> implementations would satisfy the existing QUIC requirement by not
> sending the extension and relying on the TLS stack to reject
> post-handshake authentication since the extension had not been offered.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4484

---

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 20:55:54 -0800

Another case of two comments.

The first regarding use of PSK is probably amply addressed by #4473.  Note also the use of the word "typically", which exists specifically because of this exception.

The second is something that I avoided deliberately, because it might be that we decide that there is a way to use post_handshake_auth (maybe using something embedded in certificate_request_context).  As you say, not sending the extension is the easiest path to success.

Proposal here is no change.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4484#issuecomment-755077608

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Jan 2021 21:00:56 -0800

Closed #4484.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4484#event-4193995901