Re: [TLS] Comments on TLS identity protection

[Bodo Moeller <bmoeller@xxxxxxx>]

On Tue, Dec 19, 2006 at 10:15:01PM +0100, Martin Rex wrote:

>> However, as you say in most cases the request for client auth
>> is contingent upon seeing the request and so a rehandshake is
>> required here in any case. A one-pass protocol wouldn't work
>> here.

> I had the same thought but completely failed to point this out.
> 
> In the not uncommon case with IIS renegotiating after having
> evaluated the HTTP(S)-request, [...]

This, by the way, applies not only to IIS servers.  The Apache HTTP
server with mod_ssl can also be configured to request client
certificates only for specific requests, which of course is achieved
through a renegotiation.  This approach is reasonable not only for
HTTP applications: An SMTP server supporting TLS might perform
certificate-based client authentication only when used as a mail
relay, and finish without attempting client authentication if
a connection only involves local mail delivery.

Bodo


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls