Re: [TLS] Comments on TLS identity protection

[EKR <ekr@xxxxxxxxxxxxxxxxxxxx>]

<home_pw@xxxxxxx> writes:

> Normally, client auth is not allowed on a PKI-class ciphersuite, if
> the server has not performed server auth. (In a mix of PKIand non-pki
> ciphersuites -during a change-ciher-spec between the two - things are
> admittedly more ambiguous.)
>
> On a PKI-class limited renegotiation case (or a session resumption
> case), server auth is implied, of course - assuming both enc and mac
> ciphers mechanism are not NULL.

There's no way in TLS to currently have a NULL MAC algorithm.
I doubt there is lilkely to be one soon.


> For SSL3 using the RSA ciphersuites, one can ask for client auth on
> handshake#2, without having provided server cert chain on that second
> 'shake; server auth being established in the TLS resumed session (and
> renewed Connection) state.

I don't believe that this is correct. The state machines for the
two handshakes aren't really related. What language leads you
to believe that this is OK.


> (I've still simply (and honestly) no idea what TLS1.0 TLS1.1 (or
> either of those stds with their "RFC updates" demands) being entirely
> different beasts to SSL3.)

I doubt the language has changed substantially in this respect. I
don't recall the WG clarifying this text.

-Ekr

_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls