{"action":"created","comment":{"url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments/42655809","id":42655809,"diff_hunk":"@@ -3025,17 +2931,253 @@ processing the server's Certificate, CertificateVerify, and\n Finished. If there is a failure in processing those messages, the\n client MUST discard the ServerConfiguration.\n \n+### Authentication Messages\n+\n+As discussed in {{handshake-protocol-overview}}, TLS uses a common\n+set of messages for authentication, key confirmation, and handshake\n+integrity: Certificate, CertificateVerify, and Finished. These\n+messages are always sent as the last messages in their handshake\n+flight. The Certificate and CertificateVerify messages are only\n+sent under certain circumstances, as defined below. The Finished\n+message is always sent as part of the Authentication block.\n+\n+The computations for the Authentication messages all uniformly\n+take the following inputs:\n+\n+- The certificate and signing key to be used.\n+- A Handshake Context based on the handshake hash (see {{the-handshake-hash}}).\n+- A base key to be used to compute a MAC key.\n+\n+Based on these inputs, the messages then contain:\n+\n+Certificate\n+: The certificate to be used for authentication and any\n+supporting certificates in the chain.\n+\n+CertificateVerify\n+: A signature over Handshake Context + Certificate.\n+\n+Finished\n+: A MAC over Handshake Context + Certificate + CertificateVerify using\n+  a MAC key derived from the base key.\n+{:br}\n+\n+Because the CertificateVerify signs the Handshake Context +\n+Certificate and the Finished MACs the Handshake Context + Certificate\n++ CertificateVerify, this is mostly equivalent keeping a running hash\n+of the handshake messages (exactly so in the pure 1-RTT cases). Note,\n+however, the subsequent post-handshake authentications do not include\n+each other, just the messages through the end of the main handshake.\n+\n+The following table defines the Handshake Context and MAC Key\n+for each scenario:\n+\n+~~~~\n+Mode             Handshake Context                        Base Key\n+----             -----------------                        --------\n+0-RTT            ClientHello + ServerConfiguration        xSS\n+                             + Server Certificate\n+                             + CertificateRequest\n+                            \n+1-RTT (Server)   ClientHello ... ServerConfiguration      master_secret\n+                 \n+1-RTT (Client)   ClientHello ... ServerFinished           master_secret\n+\n+Post-Handshake   ClientHello ... ClientFinished +         master_secret\n+                 CertificateRequest\n+~~~~\n+Note 1: The ServerConfiguration, CertificateRequest, and Server Certificate\n+in the 0-RTT case are the messages from the handshake where the\n+ServerConfiguration was established.\n+\n+Note 2: The Handshake Context for the last three rows does not include\n+any 0-RTT handshake messages, regardless of whether 0-RTT is used.\n+\n+\n+\n+####  Certificate\n+\n+When this message will be sent:\n+\n+> The server MUST send a Certificate message whenever the agreed-upon\n+key exchange method uses certificates for authentication (this\n+includes all key exchange methods defined in this document except PSK).\n+\n+> The client MUST send a Certificate message whenever the server has\n+requested client authentication via a CertificateRequest message\n+({{certificate-request}}) or when the EarlyDataIndication indicates\n+client authentication. This message is only sent if the server\n+requests a certificate. If no suitable certificate is available, the\n+client MUST send a Certificate message containing no certificates.\n \n-###  Server Certificate Verify\n+Meaning of this message:\n+\n+> This message conveys the endpoint's certificate chain to the peer.\n+\n+> The certificate MUST be appropriate for the negotiated cipher suite's key\n+exchange algorithm and any negotiated extensions.\n+\n+Structure of this message:\n+\n+%%% Authentication Messages\n+       opaque ASN1Cert<1..2^24-1>;\n+\n+       struct {\n+           ASN1Cert certificate_list<0..2^24-1>;\n+       } Certificate;\n+\n+certificate_list\n+: This is a sequence (chain) of certificates. The sender's\n+  certificate MUST come first in the list. Each following\n+  certificate SHOULD directly certify one preceding it. Because\n+  certificate validation requires that trust anchors be distributed\n+  independently, a certificate that specifies a\n+  trust anchor MAY be omitted from the chain, provided that\n+  supported peers are known to possess any omitted certificates.\n+{:br }\n+\n+Note: Prior to TLS 1.3, \"certificate_list\" ordering required each certificate\n+to certify the one immediately preceding it,\n+however some implementations allowed some flexibility. Servers sometimes send\n+both a current and deprecated intermediate for transitional purposes, and others\n+are simply configured incorrectly, but these cases can nonetheless be validated\n+properly. For maximum compatibility, all implementations SHOULD be prepared to\n+handle potentially extraneous certificates and arbitrary orderings from any TLS\n+version, with the exception of the end-entity certificate which MUST be first.\n+\n+The server's certificate list MUST always be non-empty. A client MAY\n+MAY send no certificates if it does not have an appropriate\n+certificate to send in response to the server's authentication\n+request.\n+\n+##### Server Certificate Selection\n+\n+The following rules apply to the certificates sent by the server:\n+\n+-  The certificate type MUST be X.509v3 {{RFC5280}}, unless explicitly negotiated\n+  otherwise (e.g., {{RFC5081}}).\n+\n+-  The server's end-entity certificate's public key (and associated\n+  restrictions) MUST be compatible with the selected key exchange\n+  algorithm.\n+\n+~~~~\n+    Key Exchange Alg.  Certificate Key Type\n+\n+    DHE_RSA            RSA public key; the certificate MUST allow the\n+    ECDHE_RSA          key to be used for signing (i.e., the\n+                       digitalSignature bit MUST be set if the key\n+                       usage extension is present) with the signature\n+                       scheme and hash algorithm that will be employed\n+                       in the server's KeyShare extension.\n+                       Note: ECDHE_RSA is defined in [RFC4492].\n+\n+    ECDHE_ECDSA        ECDSA-capable public key; the certificate MUST\n+                       allow the key to be used for signing with the\n+                       hash algorithm that will be employed in the\n+                       server's KeyShare extension.  The public key\n+                       MUST use a curve and point format supported by\n+                       the client, as described in [RFC4492].\n+~~~~\n+\n+- The \"server_name\" and \"trusted_ca_keys\" extensions {{RFC6066}} are used to\n+  guide certificate selection. As servers MAY require the presence of the server_name\n+  extension, clients SHOULD send this extension.\n+\n+All certificates provided by the server MUST be signed by a\n+hash/signature algorithm pair that appears in the \"signature_algorithms\"\n+extension provided by the client, if they are able to provide such\n+a chain (see {{signature-algorithms}}).\n+If the server cannot produce a certificate chain that is signed only via the\n+indicated supported pairs, then it SHOULD continue the handshake by sending\n+the client a certificate chain of its choice that may include algorithms\n+that are not known to be supported by the client. This fallback chain MAY\n+use the deprecated SHA-1 hash algorithm.","path":"draft-ietf-tls-tls13.md","position":818,"original_position":818,"commit_id":"6ad6e1b2dcc00e145aba587f15661d66df7292f2","original_commit_id":"21b437b150676206c827dce709419d8add4089ad","user":{"login":"ekr","id":1111457,"avatar_url":"https://avatars.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"body":"Actually, I'm not sure that this is right, since we already agreed you can just send one that violates the rules.","created_at":"2015-10-21T17:36:46Z","updated_at":"2015-10-21T17:36:46Z","html_url":"https://github.com/tlswg/tls13-spec/pull/316#discussion_r42655809","pull_request_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316","_links":{"self":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments/42655809"},"html":{"href":"https://github.com/tlswg/tls13-spec/pull/316#discussion_r42655809"},"pull_request":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316"}}},"pull_request":{"url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316","id":48355952,"html_url":"https://github.com/tlswg/tls13-spec/pull/316","diff_url":"https://github.com/tlswg/tls13-spec/pull/316.diff","patch_url":"https://github.com/tlswg/tls13-spec/pull/316.patch","issue_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/316","number":316,"state":"open","locked":false,"title":"Wip client auth revision","user":{"login":"ekr","id":1111457,"avatar_url":"https://avatars.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"body":"This is still a WIP but is posted so that people can review.","created_at":"2015-10-21T16:33:37Z","updated_at":"2015-10-21T17:36:46Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316/commits","review_comments_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316/comments","review_comment_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments{/number}","comments_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/316/comments","statuses_url":"https://api.github.com/repos/tlswg/tls13-spec/statuses/6ad6e1b2dcc00e145aba587f15661d66df7292f2","head":{"label":"ekr:WIP_client_auth_revision","ref":"WIP_client_auth_revision","sha":"6ad6e1b2dcc00e145aba587f15661d66df7292f2","user":{"login":"ekr","id":1111457,"avatar_url":"https://avatars.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"repo":{"id":19185500,"name":"tls13-spec","full_name":"ekr/tls13-spec","owner":{"login":"ekr","id":1111457,"avatar_url":"https://avatars.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/ekr/tls13-spec","description":"TLS 1.3 Specification","fork":true,"url":"https://api.github.com/repos/ekr/tls13-spec","forks_url":"https://api.github.com/repos/ekr/tls13-spec/forks","keys_url":"https://api.github.com/repos/ekr/tls13-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ekr/tls13-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ekr/tls13-spec/teams","hooks_url":"https://api.github.com/repos/ekr/tls13-spec/hooks","issue_events_url":"https://api.github.com/repos/ekr/tls13-spec/issues/events{/number}","events_url":"https://api.github.com/repos/ekr/tls13-spec/events","assignees_url":"https://api.github.com/repos/ekr/tls13-spec/assignees{/user}","branches_url":"https://api.github.com/repos/ekr/tls13-spec/branches{/branch}","tags_url":"https://api.github.com/repos/ekr/tls13-spec/tags","blobs_url":"https://api.github.com/repos/ekr/tls13-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ekr/tls13-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ekr/tls13-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/ekr/tls13-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ekr/tls13-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/ekr/tls13-spec/languages","stargazers_url":"https://api.github.com/repos/ekr/tls13-spec/stargazers","contributors_url":"https://api.github.com/repos/ekr/tls13-spec/contributors","subscribers_url":"https://api.github.com/repos/ekr/tls13-spec/subscribers","subscription_url":"https://api.github.com/repos/ekr/tls13-spec/subscription","commits_url":"https://api.github.com/repos/ekr/tls13-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/ekr/tls13-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/ekr/tls13-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/ekr/tls13-spec/issues/comments{/number}","contents_url":"https://api.github.com/repos/ekr/tls13-spec/contents/{+path}","compare_url":"https://api.github.com/repos/ekr/tls13-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ekr/tls13-spec/merges","archive_url":"https://api.github.com/repos/ekr/tls13-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ekr/tls13-spec/downloads","issues_url":"https://api.github.com/repos/ekr/tls13-spec/issues{/number}","pulls_url":"https://api.github.com/repos/ekr/tls13-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/ekr/tls13-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/ekr/tls13-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ekr/tls13-spec/labels{/name}","releases_url":"https://api.github.com/repos/ekr/tls13-spec/releases{/id}","created_at":"2014-04-26T18:47:51Z","updated_at":"2014-07-07T21:30:20Z","pushed_at":"2015-10-21T17:28:41Z","git_url":"git://github.com/ekr/tls13-spec.git","ssh_url":"git@github.com:ekr/tls13-spec.git","clone_url":"https://github.com/ekr/tls13-spec.git","svn_url":"https://github.com/ekr/tls13-spec","homepage":null,"size":2962,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3,"mirror_url":null,"open_issues_count":6,"forks":3,"open_issues":6,"watchers":0,"default_branch":"master"}},"base":{"label":"tlswg:master","ref":"master","sha":"d6b696c1593e7b5e7da28dc7f342d0ec25ba84c3","user":{"login":"tlswg","id":6699659,"avatar_url":"https://avatars.githubusercontent.com/u/6699659?v=3","gravatar_id":"","url":"https://api.github.com/users/tlswg","html_url":"https://github.com/tlswg","followers_url":"https://api.github.com/users/tlswg/followers","following_url":"https://api.github.com/users/tlswg/following{/other_user}","gists_url":"https://api.github.com/users/tlswg/gists{/gist_id}","starred_url":"https://api.github.com/users/tlswg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tlswg/subscriptions","organizations_url":"https://api.github.com/users/tlswg/orgs","repos_url":"https://api.github.com/users/tlswg/repos","events_url":"https://api.github.com/users/tlswg/events{/privacy}","received_events_url":"https://api.github.com/users/tlswg/received_events","type":"Organization","site_admin":false},"repo":{"id":18887842,"name":"tls13-spec","full_name":"tlswg/tls13-spec","owner":{"login":"tlswg","id":6699659,"avatar_url":"https://avatars.githubusercontent.com/u/6699659?v=3","gravatar_id":"","url":"https://api.github.com/users/tlswg","html_url":"https://github.com/tlswg","followers_url":"https://api.github.com/users/tlswg/followers","following_url":"https://api.github.com/users/tlswg/following{/other_user}","gists_url":"https://api.github.com/users/tlswg/gists{/gist_id}","starred_url":"https://api.github.com/users/tlswg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tlswg/subscriptions","organizations_url":"https://api.github.com/users/tlswg/orgs","repos_url":"https://api.github.com/users/tlswg/repos","events_url":"https://api.github.com/users/tlswg/events{/privacy}","received_events_url":"https://api.github.com/users/tlswg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/tlswg/tls13-spec","description":"TLS 1.3 Specification","fork":false,"url":"https://api.github.com/repos/tlswg/tls13-spec","forks_url":"https://api.github.com/repos/tlswg/tls13-spec/forks","keys_url":"https://api.github.com/repos/tlswg/tls13-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/tlswg/tls13-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/tlswg/tls13-spec/teams","hooks_url":"https://api.github.com/repos/tlswg/tls13-spec/hooks","issue_events_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/events{/number}","events_url":"https://api.github.com/repos/tlswg/tls13-spec/events","assignees_url":"https://api.github.com/repos/tlswg/tls13-spec/assignees{/user}","branches_url":"https://api.github.com/repos/tlswg/tls13-spec/branches{/branch}","tags_url":"https://api.github.com/repos/tlswg/tls13-spec/tags","blobs_url":"https://api.github.com/repos/tlswg/tls13-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/tlswg/tls13-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/tlswg/tls13-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/tlswg/tls13-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/tlswg/tls13-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/tlswg/tls13-spec/languages","stargazers_url":"https://api.github.com/repos/tlswg/tls13-spec/stargazers","contributors_url":"https://api.github.com/repos/tlswg/tls13-spec/contributors","subscribers_url":"https://api.github.com/repos/tlswg/tls13-spec/subscribers","subscription_url":"https://api.github.com/repos/tlswg/tls13-spec/subscription","commits_url":"https://api.github.com/repos/tlswg/tls13-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/tlswg/tls13-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/tlswg/tls13-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/comments{/number}","contents_url":"https://api.github.com/repos/tlswg/tls13-spec/contents/{+path}","compare_url":"https://api.github.com/repos/tlswg/tls13-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/tlswg/tls13-spec/merges","archive_url":"https://api.github.com/repos/tlswg/tls13-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/tlswg/tls13-spec/downloads","issues_url":"https://api.github.com/repos/tlswg/tls13-spec/issues{/number}","pulls_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/tlswg/tls13-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/tlswg/tls13-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/tlswg/tls13-spec/labels{/name}","releases_url":"https://api.github.com/repos/tlswg/tls13-spec/releases{/id}","created_at":"2014-04-17T17:52:32Z","updated_at":"2015-10-19T16:14:37Z","pushed_at":"2015-10-21T17:28:41Z","git_url":"git://github.com/tlswg/tls13-spec.git","ssh_url":"git@github.com:tlswg/tls13-spec.git","clone_url":"https://github.com/tlswg/tls13-spec.git","svn_url":"https://github.com/tlswg/tls13-spec","homepage":null,"size":3633,"stargazers_count":88,"watchers_count":88,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":33,"mirror_url":null,"open_issues_count":45,"forks":33,"open_issues":45,"watchers":88,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316"},"html":{"href":"https://github.com/tlswg/tls13-spec/pull/316"},"issue":{"href":"https://api.github.com/repos/tlswg/tls13-spec/issues/316"},"comments":{"href":"https://api.github.com/repos/tlswg/tls13-spec/issues/316/comments"},"review_comments":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316/comments"},"review_comment":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/316/commits"},"statuses":{"href":"https://api.github.com/repos/tlswg/tls13-spec/statuses/6ad6e1b2dcc00e145aba587f15661d66df7292f2"}}}}