Subject: Re: [TLS] TLS Digest, Vol 108, Issue 10

From: Joseph Birr-Pixton <[email-masked]>
Date: Tue, 16 Jul 2013 21:15:08 +0100

On Mon, 15 Jul 2013 16:11:27 -0700,  <[email-masked]> wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>  This draft is a work item of the Transport Layer Security Working Group of the IETF.
>
>         Title           : Out-of-Band Public Key Validation for Transport Layer Security (TLS)
>         Author(s)       : Paul Wouters
>                           Hannes Tschofenig
>                           John Gilmore
>                           Samuel Weiler
>                           Tero Kivinen
>         Filename        : draft-ietf-tls-oob-pubkey-08.txt
>         Pages           : 15
>         Date            : 2013-07-15
>
> Abstract:
>    This document specifies a new certificate type and two TLS
>    extensions, one for the client and one for the server, for exchanging
>    raw public keys in Transport Layer Security (TLS) and Datagram
>    Transport Layer Security (DTLS) for use with out-of-band public key
>    validation.

What is the rationale for having the public key communicated /both/
authentically out-of-band and inauthentically in-band?

Avoiding any inauthentic communication of the public key means failure
to establish the correct key out-of-band will mean a connection is
impossible, even in the presence of implementation bugs.

Possible rationale could include:

- allowing leap-of-faith authentication.
- allowing an endpoint to vary the public key it returns with time or
other extension content (like SNI, EC curves, etc.)
- allowing an endpoint which cannot or does not store an authentic
public key for its counterpart, but can store (say) a hash of it.

In any case, I think including the real rationale in the RFC could
prove instructive.

Cheers,
Joe