[TLS] blink intends to drop keygen and application/x-x509* handling

2015-08-11 Thread Henry Story
I just thought this group would be interested in following the thread on the blink user group "(Pre-)Intent to Deprecate: element and application/x-x509-*-cert MIME handling" https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/pX5NbX0Xack dropping those two features of the web

Re: [TLS] Review of PR #209

2015-09-22 Thread Henry Story
> On 22 Sep 2015, at 01:40, Geoffrey Keating wrote: > > Daniel Kahn Gillmor writes: > >> Consider a server has an ongoing session wrapped in TLS that uses client >> authentication to approve or deny some requests from the client. It >> remembers what requests the client has made as some sort

[TLS] Generalising DN's to SAN and IAN in TLS1.3?

2016-03-08 Thread Henry Story
Hi, I was reading with interest M. Thomson and M. Bishop's "Reactive Certificate-Based Client Authentication" draft RFC [1]. In the section 2.3 "The CERTIFICATE_REQUEST Frame" [[ CA-Count and Certificate-Authorities: "Certificate-Authorities" is a series of distinguished names o

Re: [TLS] Generalising DN's to SAN and IAN in TLS1.3?

2016-03-08 Thread Henry Story
> What more do you think you need? If that would allow one to specify that certificates that match a specific IAN are acceptable and if those get implemented widely, then that's what I was looking for. Thanks. Look forward to that :-) Henry > > -Ekr > > > On Tue, M

[TLS] X509 extension to specify use for only one origin?

2016-03-09 Thread Henry Story
Hi, The W3C TAG is working on a finding for Client Certificates that people here should find very interesting [1]. One issue that comes up a lot in discussions is the use of certificates across origins [2], which some folks find problematic, even though it clearly has its uses [3]. It seem

Re: [TLS] X509 extension to specify use for only one origin?

2016-03-09 Thread Henry Story
> On 9 Mar 2016, at 16:01, Eric Rescorla wrote: > > This is not a TLS WG issue. Where should I go to post this question? Sorry I don't know the full ecosystem. Henry > > -Ekr > > > On Wed, Mar 9, 2016 at 6:36 AM, Henry Story <mailto:henry.st...@bblfish.n

Re: [TLS] Generalising DN's to SAN and IAN in TLS1.3?

2016-03-19 Thread Henry Story
27;t care what value of those are. Is that allowed? I don't see anything regarding it when reading that section. But I may be missing something. > > -Ekr > > > On Tue, Mar 8, 2016 at 12:22 AM, Henry Story <mailto:henry.st...@bblfish.net>> wrote: > Hi, >