[TLS] Conflict between TLS 1.1 (RFC4346) and Krb5 Cipher Suite (RFC2712)

During the review of TLS 1.x while writing the Internet Draft
describing the proposed TLS_GSS ciphers, Stefan Santesson noticed
the following text from RFC4346 Section 7.4.2:

"7.4.2. Server Certificate

   "When this message will be sent:

      "The server MUST send a certificate whenever the agreed-upon key
      exchange method is not an anonymous one.  This message will always
      immediately follow the server hello message."

This text appears in all versions of TLS.  However, RFC2712 states in
Section 3:

   "The server's certificate, the client CertificateRequest, and the
   ServerKeyExchange shown in Figure 1 will be omitted since
   authentication and the establishment of a master secret will be done
   using the client's Kerberos credentials for the TLS server."

In my opinion, RFC2712's behavior is correct.  The TLS server must not
send a certificate to the client when the key exchange is being
performed in such as manner as not to rely on the public key pair
associated with a certificate.

The text in RFC4346 7.4.2 is correct assuming that certificate based
public key is the only form of server authentication.  As demonstrated
by RFC2712, there are other methods of performing server authentication
that do not involve certificates.

I propose the following change to TLS 1.2 Section 7.4.2:

  "The server MUST send a certificate whenever the agreed-upon key
   exchange method is not anonymous and does not provide an alternative
   method of server authentication.  This message will always
   immediately follow the server hello message."

This text permits the behavior described by RFC2712 and the forthcoming
TLS_GSS Internet Draft.

Jeffrey Altman

[TLS] Conflict between TLS 1.1 (RFC4346) and Krb5 Cipher Suite (RFC2712)

Attachment: smime.p7s