Subject: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

From: Mounira Msahli <[email-masked]>
Date: Fri, 24 Aug 2018 16:09:43 +0200 (CEST)

Hi all,

The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certificates is updated in accordance with TLS 1.3: https://tools.ietf.org/html/draft-tls-certieee1609-01

This document describes the use of certificates specified by the Institute of Electrical and Electronics Engineers IEEE1609.2 and the European Telecommunications Standards 

Institute ETSI TS 103097. These standards are defined in order to secure communications in vehicular environments. 

This extension is very useful and has become a pressing need for (Vehicle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...). 

We are soliciting feedback from the WG on the draft.

Kind Regards 
Mounira

---

From: William Whyte <[email-masked]>
Date: Fri, 24 Aug 2018 11:16:00 -0400

Hi all -- as editor of 1609.2 (and a contributor to 103 097) I'd like to
recommend that the WG moves forward with consideration of this draft. There
are a number of initiatives in the connected vehicle space that need TLS
with 1609.2 certificates, and in particular ISO 21177, which is currently
in ballot, assumes that TLS-with-1609.2 will be available shortly.

I have some comments on the detail of the draft which I'll share with the
editorial team, but regardless of how those comments are resolved I think
this is an important document and we should try to process it quickly.

Cheers,

William

On Fri, Aug 24, 2018 at 10:09 AM, Mounira Msahli <
[email-masked]> wrote:

> Hi all,
>
>
> The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097
> certificates is updated in accordance with TLS 1.3:
> https://tools.ietf.org/html/draft-tls-certieee1609-01
>
> This document describes the use of certificates specified by the Institute
> of Electrical and Electronics Engineers IEEE1609.2 and the European
> Telecommunications Standards
>
> Institute ETSI TS 103097. These standards are defined in order to secure
> communications in vehicular environments.
>
> This extension is very useful and has become a pressing need for
> (Vehicle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...).
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

-- 

PLEASE UPDATE YOUR ADDRESS BOOKS WITH MY NEW ADDRESS:
[email-masked]

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 24 Aug 2018 18:50:38 +0300

> We are soliciting feedback from the WG on the draft.

Some quick comments:

- I did not see requirements where to place the end-entity certificate
  anywhere. I think most TLS code outright assumes that the end-entity
  certificate is the first one.
- More generally, I did not see it specified how the certificate chain
  is laid out to the individual certficate fields (it is fairly
  obvious, but should still be specified).
- The examples could have multiple certificate types in ClientHello to
  more clearly show what is actually going on.
- You should also specify use in TLS 1.2 in the same draft (or say that
  is prohibited). This is so one only needs one reference for the
  codepoint allocation.
- I found the document quite hard to read due to various editorial
  issues.

-Ilari

---

From: Mounira Msahli <[email-masked]>
Date: Fri, 24 Aug 2018 19:42:29 +0200 (CEST)

Hi William, 

Thank you for these details. 

And we welcome your comments . 

Cheers 
Mounira

----- Mail original -----
De: "William Whyte" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>
Cc: "tls" <[email-masked]>
Envoyé: Vendredi 24 Août 2018 17:16:00
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Hi all -- as editor of 1609.2 (and a contributor to 103 097) I'd like to recommend that the WG moves forward with consideration of this draft. There are a number of initiatives in the connected vehicle space that need TLS with 1609.2 certificates, and in particular ISO 21177, which is currently in ballot, assumes that TLS-with-1609.2 will be available shortly. 
I have some comments on the detail of the draft which I'll share with the editorial team, but regardless of how those comments are resolved I think this is an important document and we should try to process it quickly. 

Cheers, 

William 

On Fri, Aug 24, 2018 at 10:09 AM, Mounira Msahli < [ mailto:[email-masked] | [email-masked] ] > wrote: 

Hi all, 

The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certificates is updated in accordance with TLS 1.3: [ https://tools.ietf.org/html/draft-tls-certieee1609-01 | https://tools.ietf.org/html/draft-tls-certieee1609-01 ] 

Kind Regards 
Mounira 
_______________________________________________ 
TLS mailing list 
[ mailto:[email-masked] | [email-masked] ] 
[ https://www.ietf.org/mailman/listinfo/tls | https://www.ietf.org/mailman/listinfo/tls ] 

-- 

PLEASE UPDATE YOUR ADDRESS BOOKS WITH MY NEW ADDRESS: [ mailto:[email-masked] | [email-masked] ]

---

From: Mounira Msahli <[email-masked]>
Date: Fri, 24 Aug 2018 19:44:36 +0200 (CEST)

Thank you Ilari, 

In response to your comments below: 

>>> We will add it.

>>> We will specify it. 

>>> We will add examples with multiple certificate types in Client Hello 

>>> It is not prohibited, for TLS 1.2 the extension is already specified: [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] 
[ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] 
We will update the draft 

>> We will update the draft 

Kind Regards 
Mounira

----- Mail original -----
De: "Ilari Liusvaara" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>
Cc: "tls" <[email-masked]>
Envoyé: Vendredi 24 Août 2018 17:50:38
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Some quick comments: 

-Ilari

---

From: Wang Haiguang <[email-masked]>
Date: Mon, 27 Aug 2018 01:44:28 +0000

Hi, Mounira

Just for clarification. 

If I am not wrong, there are two types of certificates supported by 1609.2. One is the legacy X.509 certificate, the other is the implicit certificate. 

So for you draft submitted, you plan support both types of certificates or just one of them, i.e. the X.509 certificate. 

Best regards.

Haiguang

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Mounira Msahli
Sent: Saturday, August 25, 2018 1:45 AM
To: Ilari Liusvaara <[email-masked]>
Cc: tls <[email-masked]>
Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Thank you Ilari, 

- I did not see requirements where to place the end-entity certificate anywhere. I think most TLS code outright assumes that the end-entity certificate is the first one. 

>>> We will add it.

- More generally, I did not see it specified how the certificate chain is laid out to the individual certficate fields (it is fairly obvious, but should still be specified). 
>>> We will specify it. 

- The examples could have multiple certificate types in ClientHello to more clearly show what is actually going on. 

Kind Regards 
Mounira

----- Mail original -----
De: "Ilari Liusvaara" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>
Cc: "tls" <[email-masked]>
Envoyé: Vendredi 24 Août 2018 17:50:38
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Some quick comments: 

-Ilari

---

From: Mounira Msahli <[email-masked]>
Date: Mon, 27 Aug 2018 10:31:32 +0200 (CEST)

Hi Wang, 

The purpose of the draft is to extend TLS 1.3 to support IEEE 1609.2/ETSI TS 103 097 certificates for authentication in addition to X.509 certificate and raw public keys.

Kind Regards 
Mounira 

----- Mail original -----
De: "Wang Haiguang" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>, "Ilari Liusvaara" <[email-masked]>
Cc: "tls" <[email-masked]>
Envoyé: Lundi 27 Août 2018 03:44:28
Objet: RE: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Hi, Mounira 

Just for clarification. 

Best regards. 

Haiguang 

-----Original Message----- 
From: TLS [mailto:[email-masked]] On Behalf Of Mounira Msahli 
Sent: Saturday, August 25, 2018 1:45 AM 
To: Ilari Liusvaara <[email-masked]> 
Cc: tls <[email-masked]> 
Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates 

Thank you Ilari, 

Kind Regards 
Mounira 

----- Mail original ----- 
De: "Ilari Liusvaara" <[email-masked]> 
À: "Mounira Msahli" <[email-masked]> 
Cc: "tls" <[email-masked]> 
Envoyé: Vendredi 24 Août 2018 17:50:38 
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates 

Some quick comments: 

-Ilari

---

From: Wang Haiguang <[email-masked]>
Date: Mon, 27 Aug 2018 08:43:02 +0000

Hi, Mounira

Thanks for the clarification. That means both explicit and implicit certificates will be supported. 

Regards.

Haiguang

-----Original Message-----
From: Mounira Msahli [mailto:[email-masked]] 
Sent: Monday, August 27, 2018 4:32 PM
To: Wang Haiguang <[email-masked]>
Cc: Ilari Liusvaara <[email-masked]>; tls <[email-masked]>
Subject: Re: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Hi Wang, 

Kind Regards 
Mounira 

----- Mail original -----
De: "Wang Haiguang" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>, "Ilari Liusvaara" <[email-masked]>
Cc: "tls" <[email-masked]>
Envoyé: Lundi 27 Août 2018 03:44:28
Objet: RE: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

Hi, Mounira 

Just for clarification. 

Best regards. 

Haiguang 

-----Original Message----- 
From: TLS [mailto:[email-masked]] On Behalf Of Mounira Msahli 
Sent: Saturday, August 25, 2018 1:45 AM 
To: Ilari Liusvaara <[email-masked]> 
Cc: tls <[email-masked]> 
Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates 

Thank you Ilari, 

Kind Regards 
Mounira 

----- Mail original ----- 
De: "Ilari Liusvaara" <[email-masked]> 
À: "Mounira Msahli" <[email-masked]> 
Cc: "tls" <[email-masked]> 
Envoyé: Vendredi 24 Août 2018 17:50:38 
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates 

Some quick comments: 

-Ilari

---

From: William Whyte <[email-masked]>
Date: Mon, 27 Aug 2018 07:09:30 -0400

Hi Wang,

The 1609.2 certificate format consists of both explicit and implicit
certificates. The explicit certificates are in 1609.2 format, not in X.509
format.

Cheers,

William

On Mon, Aug 27, 2018 at 4:43 AM, Wang Haiguang <
[email-masked]> wrote:

> The purpose of the draft is to extend TLS 1.3 to support IEEE 1609.2/ETSI
> TS 103 097 certificates for authentication in addition to X.509 certificate
> and raw public keys.
>
> Kind Regards
> Mounira
>
>
>
> If I am not wrong, there are two types of certificates supported by
> 1609.2. One is the legacy X.509 certificate, the other is the implicit
> certificate.
>
> So for you draft submitted, you plan support both types of certificates or
> just one of them, i.e. the X.509 certificate.
>
> Best regards.
>
> Haiguang
>
> - More generally, I did not see it specified how the certificate chain is
> laid out to the individual certficate fields (it is fairly obvious, but
> should still be specified).
> >>> We will specify it.
>
> >>> It is not prohibited, for TLS 1.2 the extension is already specified:
> [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]
> [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 |
> https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]
> We will update the draft
>
> > This document describes the use of certificates specified by the
> Institute of Electrical and Electronics Engineers IEEE1609.2 and the
> European Telecommunications Standards
> >

--

---

From: Hubert Kario <[email-masked]>
Date: Mon, 27 Aug 2018 16:39:56 +0200

On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote:
> >>> It is not prohibited, for TLS 1.2 the extension is already specified: [
> https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] We will
> update the draft

wouldn't then it be better to combine them and have one standard (document) 
that describes use in TLS 1.2 and TLS 1.3? I may be missing something but I 
don't see anything that would prevent use of the same codepoints in both 
protocol versions

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: Mounira Msahli <[email-masked]>
Date: Mon, 27 Aug 2018 18:21:15 +0200 (CEST)

Hi Hubert, 

I can do the exercise but the result will be two sections totally decorrelated: one for TLS 1.3 and one for TLS 1.2. Two drafts in one document.

- The handshake phase in TLS 1.2 is different from handshake/TLS1.3
- The certificate type is different. One uses cert_type and the other uses extension defined in [RFC7250]. 

Kind Regards 
Mounira

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 27 Aug 2018 19:34:05 +0300

On Mon, Aug 27, 2018 at 06:21:15PM +0200, Mounira Msahli wrote:
> Hi Hubert, 
> 
> I can do the exercise but the result will be two sections totally
> decorrelated: one for TLS 1.3 and one for TLS 1.2. Two drafts in
> one document.

The certificate message might be bit annoying as it has different
format in TLS 1.2 and 1.3. But most textual discussion probably can be
shared between the versions.
 
> - The handshake phase in TLS 1.2 is different from handshake/TLS1.3

One could abbrevate the handshake traces to just show the relevant
parts (which could also cut some clutter)? I think the relevant
messages always occur in the same order (clienthello, serverhello/
encryptedextensions, certificate, certificate).

> - The certificate type is different. One uses cert_type and the
> other uses extension defined in [RFC7250]. 

cert_type is deprecated. One should use the RFC7250 extensions even in
TLS 1.2. The TLS 1.3 certificate format negotiation works the same as
in TLS 1.2, with exception of extensions being in different message.

-Ilari

---

From: Watson Ladd <[email-masked]>
Date: Mon, 27 Aug 2018 08:37:50 -0800

On Mon, Aug 27, 2018, 8:21 AM Mounira Msahli <
[email-masked]> wrote:

> decorrelated: one for TLS 1.3 and one for TLS 1.2. Two drafts in one
> document.
>

Why does the first point matter? And the certificates are embedded pretty
opaquely in TLS.

---

From: Mounira Msahli <[email-masked]>
Date: Mon, 27 Aug 2018 19:24:34 +0200 (CEST)

Yes, so we can neglect the ServerHelloDone for TLS 1.2? 

The table in section 4.2.  Extensions of [RFC 8446] (TLS 1.3) indicates the messages where a given extension may
appear:
 | client_certificate_type [RFC7250]                |      CH, EE |
 |                                                  |             |
 | server_certificate_type [RFC7250]                |      CH, EE |

But in RFC 7250 (TLS 1.2), the same extensions could appear in CH and SH. 

I think, it could be better to make distinction between two TLS versions in handshake phase in terms of presentation. 

I don't have any objection to combine both in one document. 

I agree with you about the rest of comments. 

Cheers 
Mounira 

----- Mail original -----
De: "Ilari Liusvaara" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>
Cc: "tls" <[email-masked]>
Envoyé: Lundi 27 Août 2018 18:34:05
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

-Ilari

---

From: Mounira Msahli <[email-masked]>
Date: Mon, 27 Aug 2018 19:31:15 +0200 (CEST)

Why does the first point matter? And the certificates are embedded pretty opaquely in TLS. 

I think, I answered your question in my last mail?

Kind Regards 
Mounira  

----- Mail original -----
De: "Watson Ladd" <[email-masked]>
À: "Mounira Msahli" <[email-masked]>
Cc: "Hubert Kario" <[email-masked]>, "tls" <[email-masked]>
Envoyé: Lundi 27 Août 2018 18:37:50
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates

On Mon, Aug 27, 2018, 8:21 AM Mounira Msahli < [ mailto:[email-masked] | [email-masked] ] > wrote: 

Hi Hubert, 

Why does the first point matter? And the certificates are embedded pretty opaquely in TLS. 

BQ_BEGIN

Kind Regards 
Mounira 

----- Mail original ----- 
De: "Hubert Kario" < [ mailto:[email-masked] | [email-masked] ] > 
À: "tls" < [ mailto:[email-masked] | [email-masked] ] > 
Cc: "Mounira Msahli" < [ mailto:[email-masked] | [email-masked] ] >, "Ilari Liusvaara" < [ mailto:[email-masked] | [email-masked] ] > 
Envoyé: Lundi 27 Août 2018 16:39:56 
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates 

On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote: 
> >>> [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] ] 
> [ [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] | 
> [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] ] We will 
> update the draft 

-- 
Regards, 
Hubert Kario 
Senior Quality Engineer, QE BaseOS Security team 
Web: [ http://www.cz.redhat.com/ | www.cz.redhat.com ] 
Red Hat Czech s.r.o., Purkyňova 115, 612 00 Brno, Czech Republic 

BQ_END

---

From: Hubert Kario <[email-masked]>
Date: Mon, 27 Aug 2018 19:39:12 +0200

> encryptedextensions, certificate, certificate).

the draft doesn't change the order of messages, doesn't add new messages and 
doesn't change the place in which the relevant extensions are placed – so, 
what is the utility of duplicating the message flow from the TLS RFCs?

e.g. RFC 8449 and RFC 7685 don't, and they did define new extensions

>  | 

correct, this RFC 8446 table applies only to connections that negotiated TLS 
1.3

---

From: Mounira Msahli <[email-masked]>
Date: Tue, 28 Aug 2018 10:14:29 +0200 (CEST)

>>>  The extension could be specified as RFC 7250 
>>> For the extension, TLS Client and Server Handshake Behavior shall be specified for two TLS versions.

Kind Regards 
Mounira