From: Nikos Mavrogiannopoulos Date: Fri, 8 Feb 2002 20:11:09 +0000 (+0000) Subject: *** empty log message *** X-Git-Tag: gnutls_0_3_90~97 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=48fcb09fc37bf39fd6b9a17d54dab7cd4ae4e093;p=thirdparty%2Fgnutls.git *** empty log message *** --- diff --git a/doc/protocol/draft-ietf-tls-openpgp-keys-01.txt b/doc/protocol/draft-ietf-tls-openpgp-keys-01.txt index 696bd725c8..0b6e97fd92 100644 --- a/doc/protocol/draft-ietf-tls-openpgp-keys-01.txt +++ b/doc/protocol/draft-ietf-tls-openpgp-keys-01.txt @@ -1,4 +1,3 @@ -[ THIS IS NOT A DRAFT (YET) ] TLS Working Group N. Mavroyanopoulos @@ -34,8 +33,9 @@ Status of this Memo Abstract This document proposes extensions to the TLS protocol to support - OpenPGP keys, in a way that allows the use of the existing cipher - suites. + OpenPGP trust model and keys. The extensions discussed here + include a certificate type negotiation mechanism, and the required + modifications to the TLS Handshake Protocol. This document uses the same notation used in the TLS Protocol draft. @@ -53,7 +53,6 @@ Abstract - N. Mavroyanopoulos Expires ???? ??, 200? [Page 1] Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 @@ -109,14 +108,16 @@ Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 client can use, sorted by client preference. This extension SHOULD be omitted if the client supports only X.509 certificates. - The "extension_data" field of this extension will contain a - CertificateTypeExtension structure. + N. Mavroyanopoulos Expires ???? ??, 200? [Page 2] Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 + The "extension_data" field of this extension will contain a + CertificateTypeExtension structure. + enum { client, server } ClientOrServerExtension; enum { X.509(0), OpenPGP(1), (255) } CertificateType; @@ -166,15 +167,14 @@ Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 DHE_RSA RSA public key which can be used for signing. - An OpenPGP key appearing in the Certificate message will be sent - in binary OpenPGP format. The option is also available to send an - OpenPGP fingerprint, instead of sending the entire key. The - N. Mavroyanopoulos Expires ???? ??, 200? [Page 3] Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 + An OpenPGP key appearing in the Certificate message will be sent + in binary OpenPGP format. The option is also available to send an + OpenPGP fingerprint, instead of sending the entire key. The process of fingerprint generation is described in [OpenPGP]. The peer shall respond with a "certificate_unobtainable" fatal alert if the key with the given key fingerprint cannot be found. The @@ -221,18 +221,20 @@ Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 certificate_params_types is a list of accepted client certificate parameter types, sorted in order of the server's preference. -2.1.4 Client certificate - The client certificate message is sent using the same formatting as - the server certificate message. This message is only sent in response - to the certificate request message. If no OpenPGP key is available - from the client, then a certificate that contains an empty PGPKey is + N. Mavroyanopoulos Expires ???? ??, 200? [Page 4] Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 +2.1.4 Client certificate + + The client certificate message is sent using the same formatting as + the server certificate message. This message is only sent in response + to the certificate request message. If no OpenPGP key is available + from the client, then a certificate that contains an empty PGPKey is sent. The server may respond with a "handshake_failure" fatal alert if client authentication is required. This transaction follows the TLS specification. @@ -277,12 +279,6 @@ Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 CipherSuite TLS_DHE_RSA_WITH_AES_128_CBC_RMD = { 0x00, 0x78 }; CipherSuite TLS_DHE_RSA_WITH_AES_256_CBC_RMD = { 0x00, 0x79 }; - CipherSuite TLS_RSA_WITH_CAST_128_CBC_SHA = { 0x00, 0x7A }; - CipherSuite TLS_RSA_WITH_CAST_128_CBC_RMD = { 0x00, 0x7B }; - CipherSuite TLS_RSA_WITH_3DES_EDE_CBC_RMD = { 0x00, 0x7C }; - CipherSuite TLS_RSA_WITH_AES_128_CBC_RMD = { 0x00, 0x7D }; - CipherSuite TLS_RSA_WITH_AES_256_CBC_RMD = { 0x00, 0x7E }; - N. Mavroyanopoulos Expires ???? ??, 200? [Page 5] @@ -290,6 +286,12 @@ N. Mavroyanopoulos Expires ???? ??, 200? [Page 5] Internet-Draft Using OpenPGP keys for TLS Authentication January 2002 + CipherSuite TLS_RSA_WITH_CAST_128_CBC_SHA = { 0x00, 0x7A }; + CipherSuite TLS_RSA_WITH_CAST_128_CBC_RMD = { 0x00, 0x7B }; + CipherSuite TLS_RSA_WITH_3DES_EDE_CBC_RMD = { 0x00, 0x7C }; + CipherSuite TLS_RSA_WITH_AES_128_CBC_RMD = { 0x00, 0x7D }; + CipherSuite TLS_RSA_WITH_AES_256_CBC_RMD = { 0x00, 0x7E }; + All of the above cipher suites use either the CAST [CAST], AES [AES], or 3DES block ciphers in CBC mode. The choice of hash is either SHA-1 or RIPEMD-160. Implementations are not required @@ -337,11 +339,6 @@ Author's Address - - - - - N. Mavroyanopoulos Expires ???? ??, 200? [Page 6] Internet-Draft Using OpenPGP keys for TLS Authentication January 2002