Subject: [quicwg/base-drafts] Describe peer authentication (#140)

From: Martin Thomson <[email-masked]>
Date: Tue, 10 Jan 2017 15:51:04 -0800

I realized that we didn't have a lot on that point.  We should.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/140

-- Commit Summary --

  * Describe peer authentication

-- File Changes --

    M draft-ietf-quic-tls.md (19)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/140.patch
https://github.com/quicwg/base-drafts/pull/140.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/140

---

From: Alessandro Ghedini <[email-masked]>
Date: Tue, 10 Jan 2017 15:57:49 -0800

ghedo commented on this pull request.

> @@ -464,6 +464,25 @@ Get Handshake
 {: #exchange-summary title="Interaction Summary between QUIC and TLS"}

+## Peer Authentication
+
+The requirements for authentication depend on the application protocol that is
+in use.  TLS provides for server authentication and (optionally) client authentication.
+
+A client MUST authenticate the identity of the server.  This typically involves
+verification that the identity of the server is included in a certificate and
+that the certificate is issued by a trusted entity (see for example
+{{?RFC2818}}).
+
+A server MAY request that the client authenticate during the handshake. A server
+MAY refuse a connection if the client is unable to authenticate when requested.
+The conditions for client authenticate vary based on application protocol and

s/authenticate/authentication/ ?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/140#pullrequestreview-16041961

---

From: Martin Thomson <[email-masked]>
Date: Tue, 10 Jan 2017 16:43:36 -0800

@martinthomson pushed 1 commit.

2351733  Grammatical corrections

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/140/files/8608ac1a626c0aa820eab89ce915216dca327fbd..2351733f31c390940f404027e9ecf2cc3a32db96

---

From: Mike Bishop <[email-masked]>
Date: Wed, 11 Jan 2017 09:58:23 -0800

MikeBishop commented on this pull request.

> +The requirements for authentication depend on the application protocol that is
+in use.  TLS provides server authentication and permits the server to request
+client authentication.
+
+A client MUST authenticate the identity of the server.  This typically involves
+verification that the identity of the server is included in a certificate and
+that the certificate is issued by a trusted entity (see for example
+{{?RFC2818}}).
+
+A server MAY request that the client authenticate during the handshake. A server
+MAY refuse a connection if the client is unable to authenticate when requested.
+The requirements for client authentication vary based on application protocol
+and deployment.
+
+A server MUST NOT use post-handshake client authentication (see Section 4.6.2 of
+{{!I-D.ietf-tls-tls13}}).

Mmm....  Why not?  That could occur on stream 1 at any time, and should be fine, no?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/140#pullrequestreview-16196661

---

From: Martin Thomson <[email-masked]>
Date: Wed, 11 Jan 2017 14:53:33 -0800

martinthomson commented on this pull request.

We don't have the glue for it yet.  Once we have the glue parts, we can remove this paragraph.

---

From: Martin Thomson <[email-masked]>
Date: Mon, 30 Jan 2017 22:05:25 -0800

3695d35  Merge branch 'master' into client_auth

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/140/files/2351733f31c390940f404027e9ecf2cc3a32db96..3695d359b66816f854434329f1b9133bf7a460fb

---

From: Martin Thomson <[email-masked]>
Date: Mon, 30 Jan 2017 22:36:26 -0800

Merged #140.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/140#event-942569672