Subject: [TLS] new TLS-OBC revision

From: Dirk Balfanz <[email-masked]>
Date: Mon, 14 Nov 2011 10:13:58 -0800

Hi guys,

I uploaded revision 01 of the TLS-OBC draft. It's available at
http://tools.ietf.org/html/draft-balfanz-tls-obc-01.

Since the discussion here has been mostly neutral to favorable, there are
very few changes:

- a couple of editorial changes along the lines of changing a SHOULD to
MUST, fixing typos in OIDs, etc.
- some more explanation about the web origin that's embedded in the client
cert.
- fixed the reference to the Encrypted Client Certificates TLS extension
- added key length recommendations in security considerations section.

The full diff can be seen here:
http://tools.ietf.org/rfcdiff?url2=draft-balfanz-tls-obc-01

What didn't change, although it was brought up during the discussion here:

- the web origin in the client cert is still a IA5String. This is in line
with encoding of URIs in other standards, for example RFC 5280.

- I didn't talk about cookie hardening through channel binding in the
abstract, since I didn't want to conflate layers in the "normative" part of
the spec. (I left it in the security considerations section).

As always, comments are welcome! Wan-Teh will be talking about the new
revision at IETF 82 on Thursday.

Dirk.