ekr/tls-subcerts

Limited Certificate Delegation for TLS

This is the working area for the Individual internet-draft, "Limited Certificate Delegation for TLS".

• Editor's copy
• [Individual Draft] (https://tools.ietf.org/html/draft-rescorla-tls-subcerts)

Building the Draft

Formatted text and HTML versions of the draft can be built using make.

$ make

This requires that you have the necessary software installed. See the instructions.

Contributing

Before submitting feedback, please familiarize yourself with our current issues list and review the working group documents and mailing list discussion. If you're new to this, you may also want to read the Tao of the IETF.

Be aware that all contributions to the specification fall under the "NOTE WELL" terms outlined below.

1. The best way to provide feedback (editorial or design) and ask questions is sending an e-mail to our mailing list (info). This will ensure that the entire Working Group sees your input in a timely fashion.

2. If you have editorial suggestions (i.e., those that do not change the meaning of the specification), you can either:

a) Fork this repository and submit a pull request; this is the lowest friction way to get editorial changes in.

b) Submit a new issue to Github, and mention that you believe it is editorial in the issue body. It is not necessary to notify the mailing list for editorial issues.

c) Make comments on individual commits in Github. Note that this feedback is processed only with best effort by the editors, so it should only be used for quick editorial suggestions or questions.

3. For non-editorial (i.e., design) issues, you can also create an issue on Github. However, you must notify the mailing list when creating such issues, providing a link to the issue in the message body.

Note that github issues are not for substantial discussions; the only appropriate place to discuss design issues is on the mailing list itself.

NOTE WELL

Any submission to the IETF intended by the Contributor for publication as all or part of an IETF Internet-Draft or RFC and any statement made within the context of an IETF activity is considered an "IETF Contribution". Such statements include oral statements in IETF sessions, as well as written and electronic communications made at any time or place, which are addressed to:

• The IETF plenary session
• The IESG, or any member thereof on behalf of the IESG
• Any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices
• Any IETF working group or portion thereof
• Any Birds of a Feather (BOF) session
• The IAB or any member thereof on behalf of the IAB
• The RFC Editor or the Internet-Drafts function
• All IETF Contributions are subject to the rules of RFC 5378 and RFC 3979 (updated by RFC 4879).

Statements made outside of an IETF session, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not IETF Contributions in the context of this notice.

Please consult RFC 5378 and RFC 3979 for details.

A participant in any IETF activity is deemed to accept all IETF rules of process, as documented in Best Current Practices RFCs and IESG Statements.

A participant in any IETF activity acknowledges that written, audio and video records of meetings may be made and may be available to the public.

tls-subcerts's Issues

Only use subcerts if forward-secure ciphers?

It seems like subcerts won't be useful if a non-forward secure cipher is negotiated and we eventually need access to the long-term private key to decrypt the premaster secret. Does it make sense to restrict subcert usage to only some ciphers? This can be done at ServerHello time.

Related - like TLS Cached Info, why not have an indicator in ServerHello that indicates subcert support but not a commitment that a subcert will be sent? If we are using Option 2 (custom digitally signed struct), it might need to be sent as a serverhello extension anyway.

Names in sub certificates

It might be desirable for the sub-certificates to have a different identity from the main certificate.

For example if one wanted to limit the damage of stealing a sub-certificate even further a site like furniture.com could split it's domain space into multiple subdomains site1.furniture.com site2.furniture.com and give a certificate to each site.

Currently in the sub-certificate signed struct we only have expiry times, however it might be useful to add a name as well which is enforced to be a subdomain of the master cert.

Client timestamp in ClientHello extension

Since subcerts will have shorter validity than the master certs, they are more likely to cause expired/not-yet-valid errors unless the server can anticipate this error and not send the subcert (or choose a subcert with a larger validity window).

Instead of the client receiving the subcert and finding that it is not valid (hence failing the handshake), it would be better to have an indicator in the ClientHello extension, say a 4 or 8 byte timestamp, which the server can use to decide the client will accept the subcert, or to use a higher-latency mechanism like LURK.

Comments on the subcert signing structure

1. Use "TLS 1.3, " rather than "TLS, "... + {ProtocolVersion}
2. Don't forget the null byte at the end.
3. Add length and type fields to the EE cert included under the signature
4. Reorder to match the length on the wire.