Subject: [xmpp] [Fwd: Re: [TLS] Summarizing identity change discussion so far]

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 18 Dec 2009 17:02:58 -0700

FYI from the TLS list. I think we'll need to add some text about
identity changes to section 14.2.2.3 of draft-ietf-xmpp-3920bis.

--stpeter

-------- Original Message --------
Subject: Re: [TLS] Summarizing identity change discussion so far
Date: Thu, 17 Dec 2009 19:54:22 -0700
From: Peter Saint-Andre <[email-masked]>
To: [email-masked]
CC: [email-masked]
References: <[email-masked]>

On 12/17/09 4:47 PM, Martin Rex wrote:

> If a design expects certificate renewal to be necessary
> (either short lived-certs or long-lived connections) then it is
> imperative that the application performs a full re-authentication
> when the identity changes during renegotiation.

Agreed. FWIW, our text about this in draft-ietf-xmpp-3920bis currently
reads as follows (this does not yet talk about identity changes, so
we'll need to address that case as well -- e.g., the certificate might
have been replaced by a new one before the old one expired, but the data
in the cert might be different):

###

14.2.2.3. Checking of Certificates in Long-Lived Streams

   Because XMPP uses long-lived XML streams, it is possible that a
   certificate presented during stream negotiation might expire or be
   revoked while the stream is still live (this is especially relevant
   in the context of server-to-server streams).  Therefore, each party
   to a long-lived stream SHOULD:

   1.  Cache the expiration date of the certificate presented by the
       other party and any certificates on which that certificate
       depends (such as a root or intermediate certificate for a
       certification authority), and terminate the stream when any such
       certificate expires.
   2.  Periodically query the Online Certificate Status Protocol [OCSP]
       responder listed in the Authority Information Access (AIA)
       extension of the certificate presented by the other party and any
       certificates on which that certificate depends (such as a root or
       intermediate certificate for a certification authority), and
       terminate the stream if any such certificate has been revoked.

###

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls