Re: TLS-client-certificate-authentication - NOT

On Jul 25, 2011 4:24 AM, "Anders Rundgren" <anders.rundgren@telia.com>
wrote:
>
> I know that lots of security experts will argue against the following but
> I don't believe TLS-client-certificate authentication in the form of HTTPS
> as implemented in browsers is a very useful authentication scheme.
>
> In fact, quite a bunch of the entities in the EU working with consumer PKI
> have replaced TLS-c-a-a with an application level scheme which wasn't such
> a big deal since they anyway were forced writing a browser PKI client more
> or less from scratch since the ones shipped with browsers doesn't support
> PKI as defined by banks and government (like mandatory PIN codes also
> for on-line enrolled keys).

Right, an application-layer solution can work -- indeed I've proposed just
such thing myself.  The only thing I'd caution you about is the need for
channel binding of you rely on TLS for transport protection, but this is
relatively straightforward.

Nico
--