Subject: [TLS] Identity Protection Ciphersuites for TLS

From: "Ibrahim Hajjeh" <[email-masked]>
Date: Fri, 1 Dec 2006 16:34:51 +0100

Dear all,
Identity protection is increasingly required; especially in wireless
networks. For example, EAP-TLS proposes renegotiating after the first server
authentication. This requires however more cryptographic computations and
augments significantly the number of rounds trips.

Consequently, Badra and I have submitted an individual document to add
client identity protection to TLS.

The document is available for your review and comments at
http://www.ietf.org/internet-drafts/draft-hajjeh-tls-identity-protection-00.txt

Best regards,

Ibrahim
_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 1 Dec 2006 11:25:54 -0500

This capability is useful.  However, the introduction presents four
mechanisms for "client identity protection" as if they are an exhaustive
list:

            "Finally, client identity protection may be realized by
exchanging a TLS extension ..."

In addition to the described techniques for obscuring the contents of
certificates, client identity information may be protected by
provisioning users with certificates that do not require obscuring.
Context-free naming, application-specific credentials, and limited
credential lifetime are all mechanisms for protecting personally
identifiable information (i.e. client "identity") not only while in
transit over TLS sessions but while stored at the organizations at the
endpoints of those sessions.

It would be more accurate if this draft were called "Credential
Protection Ciphersuites for TLS", and if text within the draft referred
to the protection of certificates or credentials rather than protection
of client "identity".

Dave

  _____  

From: Ibrahim Hajjeh [mailto:[email-masked]] 
Sent: Friday, December 01, 2006 10:35 AM
To: [email-masked]
Subject: [TLS] Identity Protection Ciphersuites for TLS

Dear all,

Identity protection is increasingly required; especially in wireless
networks. For example, EAP-TLS proposes renegotiating after the first
server authentication. This requires however more cryptographic
computations and augments significantly the number of rounds trips. 

The document is available for your review and comments at
http://www.ietf.org/internet-drafts/draft-hajjeh-tls-identity-protection
-00.txt 

Best regards,

Ibrahim

---

From: "Ibrahim Hajjeh" <[email-masked]>
Date: Fri, 1 Dec 2006 20:23:04 +0100

Dear Dave,

Thank you very much for reading and commenting the document.

I agree with you regarding the client credentials. However, when a
ciphersuite with certificate-based authentication is chosen, the client
identity is just the client certificate. We can add that at the beginning
but if this still ambiguous, we will ratify it and replace client identity
with certificate identity.

Best regards,

Ibrahim

On 12/1/06, Kemp, David P. <[email-masked]> wrote:
> exchanging a TLS extension …"
>
>
>
> certificates, client identity information may be protected by provisioning
> users with certificates that do not require obscuring.  Context-free naming,
> application-specific credentials, and limited credential lifetime are all
> mechanisms for protecting personally identifiable information ( i.e.
> client "identity") not only while in transit over TLS sessions but while
> stored at the organizations at the endpoints of those sessions.
>
>
>
> It would be more accurate if this draft were called "Credential Protection
> Ciphersuites for TLS", and if text within the draft referred to the
> protection of certificates or credentials rather than protection of client
> "identity".
>
>
>
> Dave
>
>
>
>
>  ------------------------------
>
> *From:* Ibrahim Hajjeh [mailto: [email-masked]]
> *Sent:* Friday, December 01, 2006 10:35 AM
> *To:* [email-masked]
> *Subject:* [TLS] Identity Protection Ciphersuites for TLS
>
>
>
> Dear all,
>
> The document is available for your review and comments at http://www.ietf.org/internet-drafts/draft-hajjeh-tls-identity-protection-00.txt
>
>
> Best regards,
>
> Ibrahim
>

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 1 Dec 2006 15:35:18 -0500

Hi Ibrahim,

I apologize for not making my comments sufficiently clear and specific.
The crux of my comment is that a client certificate is *not* the same
thing as a client identity.  Your identity includes things like your
name and email address, and if these are included in your certificate,
then someone seeing your certificate in a TLS connection would know your
identity.   But if your certificate did not contain this information
(for example, if a bank issued you a certificate with just a random or
key-hash connection identifier for use when accessing your bank account)
then someone seeing this certificate in a TLS connection would see the
connection identifier but would not know the identity of the person
making the connection.  (More sophisticated examples exist, such as that
of a credential service provider generating short-term or one-time
certificates on-the-fly.)

So the purpose of the comment was to say that in addition to the methods
of protecting identity by encrypting certificates listed in the draft,
there is another method of protecting identity, namely to use
certificates that contain no personally-identifying information.  If you
want to call the draft "identity protection", then you should include
alternatives that do not require certificate encryption (and thus
require no modifications to TLS).  On the other hand, if you call it
"credential protection", then listing only the certificate encryption
alternatives in the introduction is appropriate.

Regards,

Dave

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ibrahim
Hajjeh
Sent: Friday, December 01, 2006 2:23 PM
To: Kemp, David P.
Cc: [email-masked]
Subject: Re: [TLS] Identity Protection Ciphersuites for TLS

Dear Dave, 

I agree with you regarding the client credentials. However, when a
ciphersuite with certificate-based authentication is chosen, the client
identity is just the client certificate. We can add that at the
beginning but if this still ambiguous, we will ratify it and replace
client identity with certificate identity. 

Best regards,

Ibrahim

On 12/1/06, Kemp, David P. <[email-masked]
<mailto:[email-masked]> > wrote: 

identifiable information ( i.e. client "identity") not only while in

Dave

  _____  

From: Ibrahim Hajjeh [mailto: [email-masked]] 
Sent: Friday, December 01, 2006 10:35 AM 
To: [email-masked]
Subject: [TLS] Identity Protection Ciphersuites for TLS

Dear all,

Best regards,

Ibrahim

---

From: [email-masked]
Date: Fri, 1 Dec 2006 22:33:24 +0100 (CET)

Hi Dave,

I agree that it could be nicer to rename the document "credential
protection ciphersuites for TLS" and follow your proposed text.

Best regard,
Badra