Re: [TLS] Comments on TLS identity protection

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

Martin Rex <martin.rex@xxxxxxx> writes:

> Eric Rescorla wrote:
>> 
>> The good news is that TLS has a very simple mechanism for achieving
>> this: do an ordinary TLS handshake without client authentication
>> and then do an immediate re-handshake with client auth. As the 
>> authors observe, this is slower (two sets of crypto computations
>> and 4 RTTs) than a specialized identity protection mode. However,
>> it is available now and as far as I can tell is rarely done.
>> I don't find the argument that there is a large demand for this
>> feature if it were only 50% faster particularly persuasive.
>> Rather, this seems like a premature optimization.
>
> It is not as rare as you might think.  It is actually the
> default in Microsoft's IIS with some configurations that
> IIS only requests SSL client authentication after
> having seen the request (URL).  It might be a side-effect
> of NOT requiring SSL client authentication on the root/home
> page of the webserver and only for certain areas/paths.

Good point. 

However, as you say in most cases the request for client auth
is contingent upon seeing the request and so a rehandshake is
required here in any case. A one-pass protocol wouldn't work
here.

-Ekr



_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls