Re: [TLS] Certificate URL extension in draft-ietf-tls-rfc4366-bis-02

[Eric Rescorla <ekr at networkresonance.com>]

At Thu, 24 Jul 2008 08:13:49 -0700,
Joe Salowey wrote:
> 
> I would like to get this document ready for working group last call.  I
> think there is only one major outstanding issue on the certificate URL
> extension.  
> 
> The issue is whether to make the hash mandatory in the client
> certificate URL extension.  Without the hash it presents some
> vulnerabilities in that the certificate can be replaced.  With the hash
> it will cause difficulty for clients that are issued a new certificate
> that is populated in the repository before they have a chance to
> retrieve it.  It seems that on the list there was some very rough
> consensus to make the hash mandatory.  
> 
> In order to resolve this issue I propose that we make the hash mandatory
> for this extension.  If this causes an operational problem in some
> environments then a new extension can be defined that has an optional or
> no hash.  

I agree with this plan.

-Ekr
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls