Re: [TLS] TLS document status update

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

At Tue, 29 Apr 2008 08:14:09 -0700,
Nelson B Bolyard wrote:
> 
> Pasi.Eronen@xxxxxxxxx wrote, On 2008-04-29 05:18:
> > Here's a short status update on TLS WG documents:
> 
> > draft-ietf-tls-rfc4366-bis
> >    
> >    The only technical issue is whether (and how) to mandate
> >    including the hash in certificate_url message. Everyone except
> >    Nelson has supported making the hash mandatory.
> > 
> >    If I understand Nelson's view correctly, he considers the
> >    original use case for omitting the hash (CA automatically posts
> >    renewed certificates at certain URL, and the client does not
> >    necessarily have a copy of the latest cert) more important than
> >    the (rather theoretical) attacks that omitting the hash might
> >    have. Nelson, would this be a fair summary of your objection?  
> 
> Yes.  The client doesn't necessarily have ANY copy of its own cert.
> The proposed requirement that the client MUST include a hash of the
> cert it does not have presents a new problem for such implementations.

Given that the client is about to ask the server to download a copy,
I don't really see why there's a problem with the client getting
a copy first and sending the hash over.


> White-listing of hosts from which the server is willing to fetch those
> client cert URLs effectively solves the other problems without
> necessitating any mandatory hashes.

No, it doen't solve the substitution attack.

-Ekr
_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls