Subject: [quicwg/base-drafts] Why must we not use post-handshake client auth? (#2294)

From: David Schinazi <[email-masked]>
Date: Fri, 04 Jan 2019 11:54:10 -0800

draft-tls section 4.4 (Peer Authentication) states:
> A server MUST NOT use post-handshake client authentication (see Section 4.6.2 of [TLS13]).

Why is that? Could we add a sentence explaining why not, or a reference?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2294

---

From: Martin Thomson <[email-masked]>
Date: Sun, 06 Jan 2019 14:26:50 -0800

The reason is a little complicated, and [the only citation we have]((https://httpwg.org/http-extensions/draft-ietf-httpbis-http2-secondary-certs.html#http2) is neither mature enough to cite, nor direct enough to really answer the question properly.

The problem here is mostly being able to attribute the authentication with activity at the application layer, which is hard in a highly asynchronous, concurrent protocol.  Add a sprinkling of confused deputy.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2294#issuecomment-451780927

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Jan 2019 15:26:11 -0800

Closing on the basis that this is a question and we're not obligated to explain every design choice.  PRs are always welcome for this sort of thing if you don't like that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2294#issuecomment-456604945

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Jan 2019 15:26:12 -0800

Closed #2294.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2294#event-2090249146

---

From: David Schinazi <[email-masked]>
Date: Wed, 23 Jan 2019 09:06:09 -0800

@martinthomson please don't close issues without any discussion. I've opened #2367 because I would like to see this resolved.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2294#issuecomment-456884593