Subject: Re: [TLS] TLS 1.3 wishlist

From: Henry Story <[email-masked]>
Date: Sat, 7 Dec 2013 11:15:56 +0100

On 18 Sep 2013, at 20:45, Michael D'Errico <[email-masked]> wrote:

> A "wish list" for an upcoming new version of TLS is available
> online (I found it via a message on Twitter):
> 
> https://www.ietf.org/proceedings/87/slides/slides-87-tls-5.pdf
> 
> Is it appropriate to discuss this now, prior to rechartering?

Hi,

  One thing that would be nice would be some way of having more flexibility
for the server to request a client certificate. In TLS 1.2 it seems
the only way to do this is to use the certificate_authorities
list. 

  With WebID over TLS [1] a server may in fact be satisfied if the 
Client certificate contains a WebID in the Subject Alternative Name.
But this then leaves the question open as to how the server can transmit
to the client it's ability to accept such certificates.

The only solution currently available that I know of 
would be to create a CA with DN such as

   CN=WebID, O={}

that every WebID enabled certificate would claim it is signed by (somewhere
in the certificte chain)

Then this could be passed by the server in the certificate_authorities
list as specified in http://tools.ietf.org/html/rfc5246#section-7.4.6

Some people are worried that this would require CAs to resign their root
CAs with a WebID certificate in case they wanted to release WebID 
certificates.

Is there a better way to do this currently? Could there be a better 
way to do it?

Henry

[1] https://dvcs.w3.org/hg/WebID/raw-file/tip/spec/index.html

Social Web Architect
http://bblfish.net/

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 07 Dec 2013 12:08:53 +0100

> Is there a better way to do this currently? Could there be a better 

I believe we had this discussion before, so here we go again :-)
Making TLS CCA (Client Certificate Authentication) useful for consumer authentication (be it to an enterprise, bank or social network), is IMO unrealistic, no matter how desirable it may be.

Technical reasons:
http://webpki.org/papers/PKI/webauth.pdf#page=1

TLS CCA is also at odds with the market:
http://www.forbes.com/sites/amadoudiallo/2013/11/30/google-wants-to-make-your-passwords-obsolete

As an authentication solution for VPNs (and even more "secure box-2-box" communication), TLS CCA is great but that's not "le web".

Regarding the specific WebID issue, I would be cautious about assigning additional semantics to existing constructs.
X.509 offers many other ways of signalling a unique/non-standard use.

Cheers,
Anders

---

From: Henry Story <[email-masked]>
Date: Sat, 7 Dec 2013 13:11:09 +0100

> http://webpki.org/papers/PKI/webauth.pdf#page=1

This thread is not about your ideas of what is wrong with TLS and
why you think it can never be solved, but what can be done to improve
one particular aspect that concerns me.  

Btw. your article mixes up User Interface issues which can be sorted by 
browser vendors UI team with protocol issues which I want to discuss here.
( Eg: logging out would be easy if the browser showed the client certificate
used when logged in ).  

> As an authentication solution for VPNs (and even more "secure box-2-box" communication), TLS CCA is great but that's not "le web".

WebID allows you to use X509 Certs for global authentication without needing to 
pass through CAs. We are using this every day and building some very cool apps on it. 

> X.509 offers many other ways of signalling a unique/non-standard use.

Thanks for this one paragraph that is somewhat closer to being relevant to this thread.

So clearly if one could have a better way for the server to notify the client which
certificates it accepts, this would allow selection on other fields of the certificates.
Perhaps something like a regexpression in the certificate_authorities list, or a
way to express capabilities of certificates.

Social Web Architect
http://bblfish.net/

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 07 Dec 2013 13:29:46 +0100

> one particular aspect that concerns me.

Well, the issue you bring up is pretty much related to TLS.

> ( Eg: logging out would be easy if the browser showed the client certificate

There's no logout in TLS CCA.

Currently you need a separate non-standard IDP-like thing + browser-specific logout-junk
to "emulate" what any password-using site can do using out-of-the-box solutions.

Tomcat doesn't even permit unknown CAs like required by WebID.

Note it is not WebID that's bad, it is TLS CCA.

> way to express capabilities of certificates.

IMO the best would rather be to nuke TLS CCA as the foundation for WebID.  It is
much_ simpler (note, I didn't say simple...) establishing something based on app-level security.
With WebCrypto you have it today.  With U2F it gets ubiquitous.

TLS 1.3 is as all other versions only about security enhancements.

Cheers
Anders

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 07 Dec 2013 12:06:02 +0100

Technical reasons:

Cheers,
Anders