Subject: [TLS] The use of "trusted_ca_keys" for server certificate selection

From: Xuelei Fan <[email-masked]>
Date: Tue, 20 Jun 2017 17:10:00 -0700

Hi,

In section 4.4.2.2, "Server Certificate Selection", of TLS 1.3 draft:
   https://tools.ietf.org/html/draft-ietf-tls-tls13-20#section-4.4.2.2

It is stated:

   -  The "server_name" and "trusted_ca_keys" extensions [RFC6066
<https://tools.ietf.org/html/rfc6066>] are
      used to guide certificate selection.  As servers MAY require the
      presence of the "server_name" extension, clients SHOULD send this
      extension, when applicable.

The "trusted_ca_keys" extension is not used in TLS 1.3, and is replaced
with the "certificate_authorities" extension (Section 4.2.4):

   The "trusted_ca_keys" extension, which serves a similar purpose
   [RFC6066 <https://tools.ietf.org/html/rfc6066>], but is more
complicated, is not used in TLS 1.3 (although
   it may appear in ClientHello messages from clients which are offering
   prior versions of TLS).

I guess it is a typo or a missed update to use the the "trusted_ca_keys"
extension for server certificate selection in section 4.4.2.2.  The
"certificate_authorities" extension should be used instead.

Regards,
Xuelei Fan

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 20 Jun 2017 19:18:53 -0500

On 06/20/2017 07:10 PM, Xuelei Fan wrote:
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dtls-2Dtls13-2D20-23section-2D4.4.2.2&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=KyAQ9PQE3G6JzldFVVDqIYp8yEkeejs2rSUCdjVJSRI&s=409V0VX5d_lLi5gXqSXogLkcmPAmm2tI1ej6PYSX-Xs&e=>
>
> It is stated:
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc6066&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=KyAQ9PQE3G6JzldFVVDqIYp8yEkeejs2rSUCdjVJSRI&s=PPZRuCZB6NAWaZlV9ka5krfx0GhtYzOkrvqed0LxnDQ&e=>] are
> The "trusted_ca_keys" extension is not used in TLS 1.3, and is
> replaced with the "certificate_authorities" extension (Section 4.2.4):
>    [RFC6066
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc6066&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=KyAQ9PQE3G6JzldFVVDqIYp8yEkeejs2rSUCdjVJSRI&s=PPZRuCZB6NAWaZlV9ka5krfx0GhtYzOkrvqed0LxnDQ&e=>], but is more complicated, is not used in TLS 1.3 (although
> I guess it is a typo or a missed update to use the the
> "trusted_ca_keys" extension for server certificate selection in
> section 4.4.2.2.  The "certificate_authorities" extension should be
> used instead.
>

Missed update most likely; the change log indicates that the switch from
trusted_ca_keys to certificate_authorities was made during the history
of this document.

I filed https://github.com/tlswg/tls13-spec/pull/1032 so the change
doesn't get lost.

-Ben