<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";
color:#1F497D'><o:p> </o:p></span></b></p>
<p class=MsoNormal> just that. It's not perfect (I'm still peeved that
Microsoft has<br>
effectively blocked attempts to give TLS RSA decent forward secrecy), <o:p></o:p></p>
</div>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>[Peter Williams] <o:p></o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>There is quite a history to how and when SSL rehandshake is used
(so each of n hypermedia sessions gets its own re- run of the SSL3 KDF, conducted
under the confidentiality of the initiating “IKE” security context
associated with the HTML DOM’s own security context ). Certain agencies procuring
(very) large number of office systems licenses from both Netscape and Microsoft
were rather insistent (in 1998 ish) that rehandshakes per hypermedia connection
were limited to session resumes, as opposed to rehandshakes (as in
early Netscape). <o:p></o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Use control-N in Netscape vs IE (and refresh the page) you still
see relics of the original SSL security concepts for https in a hypermedia,
multi-browser instance world. (Study the modern OCSP, too.)<o:p></o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>But this is really pretty irrelevant. We have to focus on
getting openid discovery a UCI-grade trust management model (addressing
discovery endpoint cert registration at RPs and RP affiliations) that breaks
free of “ use the trust model that works for the _interactive_ browser
user”. If one is not a security specialist in key management, I know its
hard (and boring, compared to the fun of web2.0 GUI and linking). But its
critical. Its (security) lazy just to punt to the browser model, or do what the
OS does for incoming client certs of hosting https endpoints. <o:p></o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></i></b></p>
<p class=MsoNormal><b><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>It should be obvious why I generally support the CX proposal
– as at least it puts the harder questions back on the table.</span></i></b><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>