Subject: [TLS] PR #624: Remove Supplemental Auth from TLS 1.3

From: Eric Rescorla <[email-masked]>
Date: Sat, 3 Sep 2016 12:54:00 -0700

https://github.com/tlswg/tls13-spec/pull/624

We currently have code points assigned for

 user_mapping [RFC4681]
 client_authz [RFC5878]
 server_authz [RFC5878]

These aren't well-specified for use in TLS 1.3 and my sense is that they
are barely used. Any objections to just banning them? If not, I'll merge
this
PR end of next week.

-Ekr

---

From: Andrei Popov <[email-masked]>
Date: Sat, 3 Sep 2016 21:44:55 +0000

Hi Eric,

MS TLS stack uses the user_mapping extension (to map TLS clients to Windows domain users). We do not implement client/server_authz.

Cheers,

Andrei

From: TLS [mailto:[email-masked]] On Behalf Of Eric Rescorla
Sent: Saturday, September 3, 2016 12:54 PM
To: [email-masked]
Subject: [TLS] PR #624: Remove Supplemental Auth from TLS 1.3

 user_mapping [RFC4681]
 client_authz [RFC5878]
 server_authz [RFC5878]

These aren't well-specified for use in TLS 1.3 and my sense is that they
are barely used. Any objections to just banning them? If not, I'll merge this
PR end of next week.

-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 3 Sep 2016 16:07:17 -0700

Thanks for flagging this. Looks like it can just go right before
Certificate in the client's second flight...

-Ekr

On Sat, Sep 3, 2016 at 2:44 PM, Andrei Popov <[email-masked]>
wrote:

> Hi Eric,
>
>
>
> MS TLS stack uses the user_mapping extension (to map TLS clients to
> Windows domain users). We do not implement client/server_authz.
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
>
> *From:* TLS [mailto:[email-masked]] *On Behalf Of *Eric Rescorla
> *Sent:* Saturday, September 3, 2016 12:54 PM
> *To:* [email-masked]
> *Subject:* [TLS] PR #624: Remove Supplemental Auth from TLS 1.3
>
>
>

---

From: Andrei Popov <[email-masked]>
Date: Sat, 3 Sep 2016 23:19:06 +0000

Yes, I think so.

Cheers,

Andrei

From: Eric Rescorla [mailto:[email-masked]]
Sent: Saturday, September 3, 2016 4:07 PM
To: Andrei Popov <[email-masked]>
Cc: [email-masked]
Subject: Re: [TLS] PR #624: Remove Supplemental Auth from TLS 1.3

Thanks for flagging this. Looks like it can just go right before Certificate in the client's second flight...

-Ekr

On Sat, Sep 3, 2016 at 2:44 PM, Andrei Popov <[email-masked]<mailto:[email-masked]>> wrote:
Hi Eric,

Cheers,

Andrei

From: TLS [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Eric Rescorla
Sent: Saturday, September 3, 2016 12:54 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [TLS] PR #624: Remove Supplemental Auth from TLS 1.3

 user_mapping [RFC4681]
 client_authz [RFC5878]
 server_authz [RFC5878]

-Ekr

---

From: Russ Housley <[email-masked]>
Date: Tue, 6 Sep 2016 23:58:14 -0400

I agree that client_authz and server_authz have not enjoyed much implementation.

Russ