Subject: [TLS] n00b question regarding TLS-OBC

From: Anders Rundgren <[email-masked]>
Date: Fri, 25 Oct 2013 16:34:14 +0200

If I understand it correctly TLS-OBC uses TLS CCA (Client Certificate Authentication) .

But IMO TLS CCA has a number of thorny issues like:

- TLS CCA  is incompatible with the traditional web session model
   since TLS sessions run independently of web sessions

- TLS CCA lacks a logout mechanism

- Currently there is no support for TLS session management in for example Java Servlets
 
- A bunch of rather tricky and browser-specific workarounds for coping with the
  mentioned issues makes HTTPS CCA integration in web applications complex and
  error-prone

Does this not apply to TLS OBC as well?
I like the idea very much though so I hope that I'm dead-wrong :-)

Anders

---

From: Adam Langley <[email-masked]>
Date: Fri, 25 Oct 2013 10:40:10 -0400

> If I understand it correctly TLS-OBC uses TLS CCA (Client Certificate Authentication) .

OBC did, but that got replaced for the reasons given in
https://tools.ietf.org/html/draft-balfanz-tls-channelid-00#section-2

Cheers

AGL

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 25 Oct 2013 17:04:30 +0200

> https://tools.ietf.org/html/draft-balfanz-tls-channelid-00#section-2

I'm not enough experienced in TLS to fully understand the draft
but it seems right :-)

That's great!

Cheers
Anders