Out-of-Band Public Key Validation for Transport Layer Security

The information below is for an old version of the document
Document Type None Internet-Draft (tls WG)
Last updated 2012-07-16
Replaces draft-wouters-tls-oob-pubkey
Stream IETF
Intended RFC status (None)
Expired & archived
pdf htmlized bibtex
Additional URLs
- Mailing list discussion
Stream WG state (None)
Document shepherd None
IESG IESG state Unknown state
Consensus Boilerplate Unknown
Telechat date
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at


This document specifies a new certificate type for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for use with out-of-band public key validation. Currently, TLS authentication can only occur via X.509-based Public Key Infrastructure (PKI) or OpenPGP certificates. By specifying a minimum resource for raw public key exchange, implementations can use alternative public key validation methods. One such alternative public key valiation method is offered by the DNS-Based Authentication of Named Entities (DANE) together with DNS Security. Another alternative is to utilize pre-configured keys, as is the case with sensors and other embedded devices. The usage of raw public keys, instead of X.509-based certificates, leads to a smaller code footprint. This document introduces the support for raw public keys in TLS.


Paul Wouters (paul@nohats.ca)
John Gilmore (gnu@toad.com)
Samuel Weiler (weiler@tislabs.com)
Tero Kivinen (kivinen@iki.fi)
Hannes Tschofenig (Hannes.Tschofenig@gmx.net)

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)