Nico,

This goes out of tracker issue #29.

One of the things that I am looking at for the Plasma work is the set of items 
which would be required for doing TLS and ABFAB together and what things can be 
eased.

Normally I would want to have a hard check on the name of the TLS server and 
matching w/ the certificate.  However, just like one could use ABFAB for the 
purpose of doing user authentication, I think that one can use ABFAB for doing 
server authentication.  That is one could be able to authenticate either an 
anonymous TLS server, or a TLS server with whom you do not have a trust anchor.

This would be similar to what you laid out for the use authentication method.  
That is one would setup the TLS channel, perform the ABFAB authentication with 
the required channel binding from the TLS session and then throw away the ABFAB 
work after the ABFAB has completed it authentication process (i.e. the MIC is 
checked).  At this point one should have mutual authentication, and the EAP 
channel binding should have compared the name the client is looking from (from 
the TLS certificate or the URL) with that provided by the ABFAB RP.

Does this seem a reasonable approach in some circumstances?  Are there 
circumstances you can see where this would be unreasonable?

Jim


_______________________________________________
abfab mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/abfab

Reply via email to