draft-ietf-tls-oob-pubkey-02.txt   draft-ietf-tls-oob-pubkey-03.txt 
TLS P. Wouters TLS P. Wouters
Internet-Draft No Hats Corporation Internet-Draft No Hats Corporation
Intended status: Standards Track J. Gilmore Intended status: Standards Track J. Gilmore
Expires: September 12, 2012 Expires: October 27, 2012
S. Weiler S. Weiler
SPARTA, Inc. SPARTA, Inc.
T. Kivinen T. Kivinen
AuthenTec AuthenTec
H. Tschofenig H. Tschofenig
Nokia Siemens Networks Nokia Siemens Networks
March 11, 2012 April 25, 2012
TLS Out-of-Band Public Key Validation TLS Out-of-Band Public Key Validation
draft-ietf-tls-oob-pubkey-02.txt draft-ietf-tls-oob-pubkey-03.txt
Abstract Abstract
This document specifies a new TLS certificate type for exchanging raw This document specifies a new TLS certificate type for exchanging raw
public keys in Transport Layer Security (TLS) and Datagram Transport public keys in Transport Layer Security (TLS) and Datagram Transport
Layer Security (DTLS) for use with out-of-band public key validation. Layer Security (DTLS) for use with out-of-band public key validation.
Currently, TLS authentication can only occur via X.509-based Public Currently, TLS authentication can only occur via X.509-based Public
Key Infrastructure (PKI) or OpenPGP certificates. By specifying a Key Infrastructure (PKI) or OpenPGP certificates. By specifying a
minimum resource for raw public key exchange, implementations can use minimum resource for raw public key exchange, implementations can use
alternative public key validation methods. alternative public key validation methods.
skipping to change at page 2, line 7 skipping to change at page 2, line 7
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 12, 2012. This Internet-Draft will expire on October 27, 2012.
Copyright Notice Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 14 skipping to change at page 3, line 14
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. TLS Handshake Extension . . . . . . . . . . . . . . . . . . . . 5 3. TLS Handshake Extension . . . . . . . . . . . . . . . . . . . . 5
3.1. Client Hello . . . . . . . . . . . . . . . . . . . . . . . 5 3.1. Client Hello . . . . . . . . . . . . . . . . . . . . . . . 5
3.2. Server Hello . . . . . . . . . . . . . . . . . . . . . . . 6 3.2. Server Hello . . . . . . . . . . . . . . . . . . . . . . . 6
3.3. Certificate Request . . . . . . . . . . . . . . . . . . . . 7 3.3. Certificate Request . . . . . . . . . . . . . . . . . . . . 7
3.4. Other Handshake Messages . . . . . . . . . . . . . . . . . 7 3.4. Other Handshake Messages . . . . . . . . . . . . . . . . . 7
3.5. Client authentication . . . . . . . . . . . . . . . . . . . 7
4. Security Considerations . . . . . . . . . . . . . . . . . . . . 7 4. Security Considerations . . . . . . . . . . . . . . . . . . . . 7
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 7 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 8
6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 8 6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 8
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 8 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 8
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 8
8.1. Normative References . . . . . . . . . . . . . . . . . . . 8 8.1. Normative References . . . . . . . . . . . . . . . . . . . 8
8.2. Informative References . . . . . . . . . . . . . . . . . . 8 8.2. Informative References . . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 9 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 9
1. Introduction 1. Introduction
Traditionally, TLS server public keys are obtained in PKIX containers Traditionally, TLS server public keys are obtained in PKIX containers
skipping to change at page 7, line 18 skipping to change at page 7, line 18
3.3. Certificate Request 3.3. Certificate Request
The semantics of this message remain the same as in the TLS The semantics of this message remain the same as in the TLS
specification. specification.
3.4. Other Handshake Messages 3.4. Other Handshake Messages
All the other handshake messages are identical to the TLS All the other handshake messages are identical to the TLS
specification. specification.
3.5. Client authentication
Client authentication by the TLS server is supported only through
authentication of the received client SubjectPublicKeyInfo via an
out-of-band method
4. Security Considerations 4. Security Considerations
The transmission of raw public keys, as described in this document, The transmission of raw public keys, as described in this document,
provides benefits by lowering the over-the-air transmission overhead provides benefits by lowering the over-the-air transmission overhead
since raw public keys are quite naturally smaller than an entire since raw public keys are quite naturally smaller than an entire
certificate. There are also advantages from a codesize point of view certificate. There are also advantages from a codesize point of view
for parsing and processing these keys. The crytographic procedures for parsing and processing these keys. The crytographic procedures
for assocating the public key with the possession of a private key for assocating the public key with the possession of a private key
also follows standard procedures. also follows standard procedures.
skipping to change at page 8, line 46 skipping to change at page 9, line 6
8.2. Informative References 8.2. Informative References
[Defeating-SSL] [Defeating-SSL]
Marlinspike, M., "New Tricks for Defeating SSL in Marlinspike, M., "New Tricks for Defeating SSL in
Practice", February 2009, <http://www.blackhat.com/ Practice", February 2009, <http://www.blackhat.com/
presentations/bh-dc-09/Marlinspike/ presentations/bh-dc-09/Marlinspike/
BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf>. BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf>.
[I-D.ietf-core-coap] [I-D.ietf-core-coap]
Frank, B., Bormann, C., Hartke, K., and Z. Shelby, Shelby, Z., Hartke, K., Bormann, C., and B. Frank,
"Constrained Application Protocol (CoAP)", "Constrained Application Protocol (CoAP)",
draft-ietf-core-coap-08 (work in progress), October 2011. draft-ietf-core-coap-09 (work in progress), March 2012.
[I-D.ietf-dane-protocol] [I-D.ietf-dane-protocol]
Hoffman, P. and J. Schlyter, "The DNS-Based Authentication Hoffman, P. and J. Schlyter, "The DNS-Based Authentication
of Named Entities (DANE) Protocol for Transport Layer of Named Entities (DANE) Protocol for Transport Layer
Security (TLS)", draft-ietf-dane-protocol-18 (work in Security (TLS)", draft-ietf-dane-protocol-19 (work in
progress), March 2012. progress), April 2012.
[I-D.ietf-tls-cached-info] [I-D.ietf-tls-cached-info]
Santesson, S. and H. Tschofenig, "Transport Layer Security Santesson, S. and H. Tschofenig, "Transport Layer Security
(TLS) Cached Information Extension", (TLS) Cached Information Extension",
draft-ietf-tls-cached-info-11 (work in progress), draft-ietf-tls-cached-info-11 (work in progress),
December 2011. December 2011.
[LDAP] Sermersheim, J., "Lightweight Directory Access Protocol [LDAP] Sermersheim, J., "Lightweight Directory Access Protocol
(LDAP): The Protocol", RFC 4511, June 2006. (LDAP): The Protocol", RFC 4511, June 2006.
 End of changes. 10 change blocks. 
9 lines changed or deleted 16 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/