W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2015

Re: Report on preliminary decision on TLS 1.3 and client auth

From: Amos Jeffries <squid3@treenet.co.nz>
Date: Thu, 24 Sep 2015 15:56:10 +1200
To: Martin Thomson <martin.thomson@gmail.com>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Message-ID: <5603745A.7020509@treenet.co.nz>
On 24/09/2015 3:41 p.m., Martin Thomson wrote:
> On 23 September 2015 at 19:02, Amos Jeffries wrote:
>>
>> Option 2 risks the same mess if the AUTH frame is defined end-to-end.
>> But a per-hop frame would work nicely as long as it is clear to server
>> implementers that intermediaries may be the source of the certificate.
>> Not some "user".
> 
> This would naturally be hop-by-hop, by virtue of extensions being
> hop-by-hop and by virtue of the setting that enables it also being
> hop-by-hop.
> 
>> An option 3 might be to use a SETTINGS instead of dedicated AUTH frame.
>> So that the per-hop nature is made extra clear. That would also be more
>> backward compatible with older h2 implementations and work in with
>> clearing dynamic compression contexts at the same time as authenticating.
> 
> SETTINGS wouldn't allow the server to correlate the CertificateRequest
> with a specific request/response exchange.

Ah. Sorry I seem to have misunderstood yoru meaning of "provides the
proof that a server needs to regard the entire session to be authentic"
to mean the cert was connection-wide.

If it is stream-specific in terms of HTTP/2 streams rather than TLS
streams, then the frame as in option 2 should be okay. Option 1 still
has major issues with www-auth vs proxy-auth.

> 
> Also, while I think of it, we should probably forbid the use of this
> on server-initiated streams (i.e., with server push).  That could
> cause problems.
> 

I can see that as being a SHOULD NOT, or forbid on PUSH_PROMISE
specifically. But using a more general definitio like "server initiated"
may cause conflicts with the bi-directional h2 extension.

Amos
Received on Thursday, 24 September 2015 03:57:16 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 17:14:46 UTC