Subject: [xmpp] #43: receiving entity should request certificate during TLS negotiation

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 00:29:21 -0000

#43: receiving entity should request certificate during TLS negotiation
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  trivial             |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 5.3.3.1 (which covers rules for TLS negotiation) states:

 > 3.  The receiving entity SHOULD send a certificate request to the
 > initiating entity so that mutual authentication will be possible.

 Dave Cridland commented: "My understanding is that an initiating entity
 MAY send a certificate whether or not the receiving entity asks for one,
 so I see no value in (3)."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/43>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 14:45:51 -0600

> #43: receiving entity should request certificate during TLS negotiation

Is there harm in encouraging servers to send certificate requests?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 15:09:26 -0600

On 6/23/10 2:51 PM, Dave Cridland wrote:
> On Wed Jun 23 21:45:51 2010, Peter Saint-Andre wrote:
> There is, as far as I'm aware, no harm in sending a certificate request,
> however I think that the initiating entity SHOULD, or possibly MUST,
> send a certificate whether or not it's asked. 

Sure. This would need to be a conditional should or conditional must,
given that some (most?) clients will not have a certificate to send.

> It MAY choose one of a
> number of possible certificates depending on the authorities  advertised
> - assuming that there are authorities advertised there, which I think
> there are.

Forgive my ignorance, but "depending on the authorities advertised"
implies that the receiving entity can or does or must advertise the
authorities that it recognizes -- is that in fact the case?

> So it's not the asking I'm scared of, it's the waiting to be asked.

I think we're trying to encourage behavior that will enable mutual auth
from both the client side and the server side.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 16:41:41 -0600

On 6/23/10 3:15 PM, Dave Cridland wrote:
> On Wed Jun 23 22:09:26 2010, Peter Saint-Andre wrote:
> Right, sure.
> I think so, but I'm not 100% sure, hence my hand-waving above.
> 
> 
> Oh, absolutely.

How about this?

   3.  So that mutual authentication will be possible, the receiving
       entity SHOULD send a certificate request to the initiating entity
       and the initiating entity SHOULD send a certificate (if
       available) to the receiving entity.

/psa

---

From: "xmpp issue tracker" <[email-masked]>
Date: Thu, 24 Jun 2010 00:56:44 -0000

#43: receiving entity should request certificate during TLS negotiation
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  trivial             |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Fixed with this text:

-- 
Ticket URL: <http://svn.tools.ietf.org/wg/xmpp/trac/ticket/43#comment:1>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Dave Cridland <[email-masked]>
Date: Wed, 23 Jun 2010 21:51:16 +0100

> > #43: receiving entity should request certificate during TLS  

There is, as far as I'm aware, no harm in sending a certificate  
request, however I think that the initiating entity SHOULD, or  
possibly MUST, send a certificate whether or not it's asked. It MAY  
choose one of a number of possible certificates depending on the  
authorities  advertised - assuming that there are authorities  
advertised there, which I think there are.

Dave.

---

From: Dave Cridland <[email-masked]>
Date: Wed, 23 Jun 2010 22:15:44 +0100

On Wed Jun 23 22:09:26 2010, Peter Saint-Andre wrote:
> >> >  Dave Cridland commented: "My understanding is that an  
> initiating
> >> entity
> >> >  MAY send a certificate whether or not the receiving entity  
> asks for
> >> one,
> request,
Right, sure.

Oh, absolutely.

Dave.