Subject: [TLS] draft-ietf-tls-oob-pubkey-09: client auth, but no client key

From: Hauke Mehrtens <[email-masked]>
Date: Mon, 30 Sep 2013 16:51:29 +0200

RFC 5246 7.4.6 "Client Certificate" says:

      If no suitable certificate is available,
      the client MUST send a certificate message containing no
      certificates.  That is, the certificate_list structure has a
      length of zero.

How should a client act when raw public keys are used and the server
requests client authentication, but there is no public key or no
suitable public key?

Not adding client_certificate_type to the ClientHello is not enough,
because this could also indicate that the client supports client
authentication with X.509 certificates.

I would send an empty client certificate handshake message and no
certificate verify message and the server should decide, like it is
specified for X.509 certificates in RFC 5246 7.4.6.

Hauke