Subject: [TLS] Unified Client Authentication

From: Watson Ladd <[email-masked]>
Date: Sun, 21 Feb 2016 11:33:57 -0800

Currently we client authenticate after handshake and during handshake.
Why not unify these by making all client authentication take place
after the handshake? This will simplify the state machine.

https://github.com/tlswg/tls13-spec/issues/421 talks about this in the
last sentence.

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 21 Feb 2016 11:38:59 -0800

This was discussed at the TLS interim and the argument against was that
there was limited demand for the post-handshake mode and that people
wanted to have a mode they were very comfortable with as the "main"
thing. Of course, it may be time to revisit that decision.

-Ekr

On Sun, Feb 21, 2016 at 11:33 AM, Watson Ladd <[email-masked]> wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Martin Thomson <[email-masked]>
Date: Sun, 21 Feb 2016 11:39:51 -0800

> after the handshake? This will simplify the state machine.

I believe that we discussed this extensively at the last interim.  I
believe that two views held:

1. post-handshake client auth is an abomination that only exists to
support a few niche use cases.

2. doing it after the handshake creates a period of uncertainty for
clients, who might receive the server Finished and start to transmit
unauthenticated messages before receiving the request

Excuse my colloquial description of the problems.