Nico, This goes out of tracker issue #29.
One of the things that I am looking at for the Plasma work is the set of items which would be required for doing TLS and ABFAB together and what things can be eased. Normally I would want to have a hard check on the name of the TLS server and matching w/ the certificate. However, just like one could use ABFAB for the purpose of doing user authentication, I think that one can use ABFAB for doing server authentication. That is one could be able to authenticate either an anonymous TLS server, or a TLS server with whom you do not have a trust anchor. This would be similar to what you laid out for the use authentication method. That is one would setup the TLS channel, perform the ABFAB authentication with the required channel binding from the TLS session and then throw away the ABFAB work after the ABFAB has completed it authentication process (i.e. the MIC is checked). At this point one should have mutual authentication, and the EAP channel binding should have compared the name the client is looking from (from the TLS certificate or the URL) with that provided by the ABFAB RP. Does this seem a reasonable approach in some circumstances? Are there circumstances you can see where this would be unreasonable? Jim _______________________________________________ abfab mailing list [email protected] https://www.ietf.org/mailman/listinfo/abfab
