Subject: [NNTP] One more STARTTLS issue

From: Russ Allbery <[email-masked]>
Date: Mon, 15 Aug 2005 08:33:31 -0700

Sorry, I missed this.

I don't think we did anything about this portion of Sam's review of
STARTTLS:

| The TLS document discusses certificate matching but does not discuss
| certificate verification.  I'd recommend using the certificate
| verification specified in RFC 3280.  You certainly need to say
| something about verification.

I think this may be as simple as inserting a sentence or so with a
normative reference to RFC 3280.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Ken Murchison <[email-masked]>
Date: Mon, 15 Aug 2005 12:15:13 -0400

> normative reference to RFC 3280.

Suggested wording?  Is this a SHOULD or a MUST?

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     2495 Main St. - Suite 401
716-604-0088 x26      Buffalo, NY 14214
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: Russ Allbery <[email-masked]>
Date: Mon, 15 Aug 2005 09:43:45 -0700

> Suggested wording?  Is this a SHOULD or a MUST?

How does this sound:

    To prevent man-in-the-middle attacks, clients MUST verify the binding
    between the identity of the server to which the client was connecting
    and the public key presented by the server.  Clients SHOULD implement
    the algorithm in section 6 of [RFC3280] for general certificate
    validation, but MAY supplement that algorithm with other validation
    methods that achieve equivalent levels of verification (such as
    comparing the server certificate against a local store of
    already-verified certificates and identity bindings).

---

From: Ken Murchison <[email-masked]>
Date: Mon, 15 Aug 2005 13:26:17 -0400

>     already-verified certificates and identity bindings).

Sounds good to me.  Do you want to run it by Sam?  Should I spin another 
draft after we add this (or equivalent) wording?

---

From: Russ Allbery <[email-masked]>
Date: Mon, 15 Aug 2005 10:30:47 -0700

> Sounds good to me.  Do you want to run it by Sam?

I'll do that now.

> Should I spin another draft after we add this (or equivalent) wording?

Yes.

I'll let you know what Sam says.