Subject: [TLS] X509 extension to specify use for only one origin?

From: Henry Story <[email-masked]>
Date: Wed, 9 Mar 2016 14:36:20 +0000

Hi,

  The W3C TAG is working on a finding for Client Certificates that 
people here should find very interesting [1]. 

One issue that comes up a lot in discussions is the use of certificates
across origins [2], which some folks find problematic, even though it 
clearly has its uses [3].

 It seems that this could be solved neatly with an X509 extension
limiting usage to a certain origin or set of origins. I would not
be surprised if this already exists. With browser chrome support this
would allow the full range of uses from FIDO to cross origin ones
whilst putting the user in control.

Henry

[1] https://github.com/w3ctag/client-certificates
[2] https://github.com/w3ctag/client-certificates/issues/1
[3] https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 9 Mar 2016 08:01:05 -0800

This is not a TLS WG issue.

-Ekr

On Wed, Mar 9, 2016 at 6:36 AM, Henry Story <[email-masked]> wrote:

> [3]
> https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Henry Story <[email-masked]>
Date: Wed, 9 Mar 2016 16:08:28 +0000

> On 9 Mar 2016, at 16:01, Eric Rescorla <[email-masked]> wrote:
> 

Where should I go to post this question? Sorry I don't know the full ecosystem.

Henry

> 
> -Ekr
> 
> 
> On Wed, Mar 9, 2016 at 6:36 AM, Henry Story <[email-masked] <mailto:[email-masked]>> wrote:
> Hi,
> 
> [1] https://github.com/w3ctag/client-certificates <https://github.com/w3ctag/client-certificates>
> [2] https://github.com/w3ctag/client-certificates/issues/1 <https://github.com/w3ctag/client-certificates/issues/1>
> [3] https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303 <https://github.com/w3ctag/client-certificates/issues/1#issuecomment-194318303>
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/tls <https://www.ietf.org/mailman/listinfo/tls>
>

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 9 Mar 2016 08:09:42 -0800

Not sure who is managing certs now that PKIX is closed. Try SAAG.

-Ekr

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 9 Mar 2016 16:41:27 +0000

On the other hand, while it’s not a TLS issue per-se, this is the place most likely to have folks who care and are interested.

--
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Sean Leonard <[email-masked]>
Date: Thu, 10 Mar 2016 18:04:23 -0800

I think it is interesting. A good place to take it up is the pkix 
mailing list anyway. See what people say.

As far as experimenting, it is not difficult to create a new X.509/PKIX 
extension. Just create an OID for your experimental use in whatever arc 
you have at your disposal, and go.

Sean

On 3/9/2016 8:41 AM, Salz, Rich wrote:
>
> On the other hand, while it’s not a TLS issue per-se, this is the 
> place most likely to have folks who care and are interested.
>
> -- 
>