Out-of-Band Public Key Validation for Transport Layer Security
draft-ietf-tls-oob-pubkey-04
| The information below is for an old version of the document | |||||
|---|---|---|---|---|---|
| Document | Type | None Internet-Draft (tls WG) | |||
| Last updated | 2012-07-16 | ||||
| Replaces | draft-wouters-tls-oob-pubkey | ||||
| Stream | IETF | ||||
| Intended RFC status | (None) | ||||
| Formats |
Expired & archived
pdf
htmlized
bibtex
|
||||
| Reviews | |||||
| Additional URLs |
|
||||
| Stream | WG state | (None) | |||
| Document shepherd | None | ||||
| IESG | IESG state | Unknown state | |||
| Consensus Boilerplate | Unknown | ||||
| Telechat date | |||||
| Responsible AD | (None) | ||||
| Send notices to | (None) | ||||
https://www.ietf.org/archive/id/draft-ietf-tls-oob-pubkey-04.txt
Abstract
This document specifies a new certificate type for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for use with out-of-band public key validation. Currently, TLS authentication can only occur via X.509-based Public Key Infrastructure (PKI) or OpenPGP certificates. By specifying a minimum resource for raw public key exchange, implementations can use alternative public key validation methods. One such alternative public key valiation method is offered by the DNS-Based Authentication of Named Entities (DANE) together with DNS Security. Another alternative is to utilize pre-configured keys, as is the case with sensors and other embedded devices. The usage of raw public keys, instead of X.509-based certificates, leads to a smaller code footprint. This document introduces the support for raw public keys in TLS.
Authors
Paul Wouters
(paul@nohats.ca)
John Gilmore
(gnu@toad.com)
Samuel Weiler
(weiler@tislabs.com)
Tero Kivinen
(kivinen@iki.fi)
Hannes Tschofenig
(Hannes.Tschofenig@gmx.net)
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)