Out-of-Band Public Key Validation for Transport Layer Security
draft-ietf-tls-oob-pubkey-04
The information below is for an old version of the document | |||||
---|---|---|---|---|---|
Document | Type | None Internet-Draft (tls WG) | |||
Last updated | 2012-07-16 | ||||
Replaces | draft-wouters-tls-oob-pubkey | ||||
Stream | IETF | ||||
Intended RFC status | (None) | ||||
Formats |
Expired & archived
pdf
htmlized
bibtex
|
||||
Reviews | |||||
Additional URLs |
|
||||
Stream | WG state | (None) | |||
Document shepherd | None | ||||
IESG | IESG state | Unknown state | |||
Consensus Boilerplate | Unknown | ||||
Telechat date | |||||
Responsible AD | (None) | ||||
Send notices to | (None) |
https://www.ietf.org/archive/id/draft-ietf-tls-oob-pubkey-04.txt
Abstract
This document specifies a new certificate type for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for use with out-of-band public key validation. Currently, TLS authentication can only occur via X.509-based Public Key Infrastructure (PKI) or OpenPGP certificates. By specifying a minimum resource for raw public key exchange, implementations can use alternative public key validation methods. One such alternative public key valiation method is offered by the DNS-Based Authentication of Named Entities (DANE) together with DNS Security. Another alternative is to utilize pre-configured keys, as is the case with sensors and other embedded devices. The usage of raw public keys, instead of X.509-based certificates, leads to a smaller code footprint. This document introduces the support for raw public keys in TLS.
Authors
Paul Wouters
(paul@nohats.ca)
John Gilmore
(gnu@toad.com)
Samuel Weiler
(weiler@tislabs.com)
Tero Kivinen
(kivinen@iki.fi)
Hannes Tschofenig
(Hannes.Tschofenig@gmx.net)
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)