address, potentially followed by a transport layer port number, are usually used in the authority component for the "http" and "coap" schemes.  The path and query contain data to identify a resource <del> within the scope of the URI's scheme and naming authority.  The path is hierarchical; the query is non-hierarchical.  The fragment allows to refer to some portion of the resource, such as a section in an HTML document. </del>  For RESTful IoT applications, typical schemes include "https", "coaps", "http", and "coap".  These refer to HTTP and CoAP, with and example, a GET request may use query parameters to request the server to send only certain kind data of the resource (i.e., filtering the response).  Query parameters in PUT and POST requests do not have <del> such established semantics and are not commonly used. </del>  3.5. 5. The authors would like to thank Mert Ocak, Heidi-Maria Back, Tero <del> Kauppinen, and Michael Koster for the reviews and feedback. </del>

Removed "path is hierarchical query not" comment. Added note about query component order being unspecified.
This addresses issue
URL
Fixed in PR Hi, In reading draft-keranen-t2trg-rest-iot-01 I note the following: It is my understanding that this statement is subject to debate. Certainly some RESTful APIs assign hierarchical semantics to the path. For example, /foo may refer to a "collection-style" resource and /foo/bar may refer to a resource within that collection. However, is this a necessary requirement? From my perspective, this could potentially limit extensibility as future revisions of a RESTful API may, for instance, wish to insert a resource "between" /foo and /foo/bar. If the resources themselves are truly self-describing, containing links to "subordinate" resources, then the path portion of the URI can become an opaque identifier and backward compatibility in this hypothetical RESTful API could be maintained. Likewise, I have seen RESTful APIs where the order of the elements in the query portion of the URI matters (particularly if a given element occurs multiple times). I would suggest staying silent on the semantics of these parts of the URI or noting that they MAY be hierarchical / non-hierarchical. Thanks, Robby

address, potentially followed by a transport layer port number, are usually used in the authority component for the "http" and "coap" schemes.  The path and query contain data to identify a resource  <ins> within the scope of the URI's scheme and naming authority.  The fragment allows to refer to some portion of the resource, such as a section in an HTML document. </ins> For RESTful IoT applications, typical schemes include "https", "coaps", "http", and "coap".  These refer to HTTP and CoAP, with and example, a GET request may use query parameters to request the server to send only certain kind data of the resource (i.e., filtering the response).  Query parameters in PUT and POST requests do not have  <ins> such established semantics and are not commonly used.  Whether the order of the query parameters matters in URIs is unspecified and they can be re-ordered e.g., by proxies.  Therefore applications should not rely on their order; see Section 3.3 of RFC6943 for more details. </ins> 3.5. 5. The authors would like to thank Mert Ocak, Heidi-Maria Back, Tero  <ins> Kauppinen, Michael Koster, Robby Simpson, Ravi Subramaniam, and Dave Thaler for the reviews and feedback. </ins>


provide application programming interfaces by which clients and servers may request and verify exported authenticator messages.  Given an established connection, the application SHOULD be able to call the following APIs:

Relaying feedback received: We currently require EMS+TLS 1.2 or TLS 1.3+ in order for the Exported Authenticator API to be validly used. However, the definition of the APIs don't explicitly call out a failure path. We should probably address this. Simplest option would be to add a sentence to the description of each API that it fails if those conditions aren't met.

provide application programming interfaces by which clients and servers may request and verify exported authenticator messages. <ins> Notwithstanding the success cases described below, all APIs MUST fail if: the connection uses a TLS version of 1.1 or earlier, or the connection is TLS 1.2 and the extended master secret RFC7627 was not used </ins> Given an established connection, the application SHOULD be able to call the following APIs:


This message does not include the TLS record layer and is therefore not encrypted with a handshake key. <del> This message is used to define the parameters in a request for an authenticator. </del>  An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  The but different parameters.  These messages do not include the TLS record layer and are therefore not encrypted with a handshake key.  Each authenticator is computed using a Handshake Context and Finished MAC Key derived from the TLS session.  These values are derived using an exporter as described in RFC5705 (for TLS 1.2) or TLS13 (for TLS computed with the extended master secret RFC7627 to avoid key synchronization attacks. <del> The certificate to be used for authentication and any supporting certificates in the chain.  This structure is defined in TLS13, Section 4.4.2. </del>  The certificate message contains an opaque string called certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is provided, it is zero-length. <del> This message is used to provide explicit proof that an endpoint possesses the private key corresponding to its certificate. </del>  The algorithm field specifies the signature algorithm used (see Section 4.2.3 of TLS13 for the definition of this field).  The <del> signature is a digital signature using that algorithm.  The signature scheme MUST be a valid signature scheme for TLS 1.3.  This excludes all RSASSA-PKCS1-v1_5 algorithms and ECDSA algorithms that are not supported in TLS 1.3.  If an authenticator request is present, the signature algorithm MUST be chosen from one of the signature schemes in the authenticator request.  Otherwise, the signature algorithm used should be chosen from the "signature_algorithms" extension of the ClientHello used in the connection handshake. </del>  The signature is computed using the over the concatenation of: A single 0 byte which serves as the separator <del> If the authenticator request is present, the value "Hash(Handshake Context || authenticator request || Certificate)" </del>  <del> If an authenticator request is not present, the value "Hash(Handshake Context || Certificate)" </del>  <del> where Hash is the hash function for the handshake. </del>  <del> A HMAC over the value Hash(Handshake Context || Certificate || CertificateVerify) if an authenticator is present, or Hash(Handshake Context || authenticator request || Certificate || CertificateVerify) where Hash is the hash function for the handshake, and the HMAC is computed using the hash function from the handshake and the Finished MAC Key as a key. </del>  <del> The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the version of TLS negotiated.  If an authenticator request is present, the signature algorithms used to choose the algorithm are taken from the "signature_algorithms" in the from the authenticator.  If there is no authenticator request, the signature algorithms are chosen from the "signature_algorithms" extension from the ClientHello used in the connection.  This is described in Section 4.2.3 of TLS13 and Sections 7.4.2 and 7.4.6 of RFC5246.  Alternative certificate formats such as RFC7250 Raw Public Keys are not supported.  The "server_name" RFC6066, "certificate_authorities" (Section 4.2.4. of TLS13), or "oid_filters" (Section 4.2.5. of TLS13) extensions are used to guide certificate selection, with the extensions provided in the authenticator request taking precedence over the extensions provided in the connection handshake. </del>  <del> If an authenticator request was provided, the Certificate message MUST contain only extensions present in the authenticator request. Otherwise, the Certificate message MUST contain only extensions present in the ClientHello. </del>  <del> The authenticator message is the concatenation of messages: Certificate || CertificateVerify || Finished </del>  A given authenticator can be validated by checking the validity of the CertificateVerify message given the authenticator request (if provide application programming interfaces by which clients and servers may request and verify exported authenticator messages. <del> Notwithstanding the success cases described below, all APIs MUST fail if: </del>  the connection uses a TLS version of 1.1 or earlier, or the connection is TLS 1.2 and the extended master secret RFC7627 was not used <del> Given an established connection, the application SHOULD be able to call the following APIs: </del>  <del> "request", which takes as input: </del>  certificate_request_context (from 0 to 255 bytes) It returns an authenticator request, which is a sequence of octets that includes a CertificateRequest message. <del> "get context", which takes as input </del>  authenticator It returns the certificate_request_context. <del> "authenticate", which takes as input: </del>  a set of certificate chains and associated extensions (OCSP, SCT, etc.) an optional authenticator request <del> It returns the exported authenticator as output.  It is RECOMMENDED that the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library. Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. </del>  It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the application does not have access to a TLS library with these APIs or when TLS is handled independently of the application layer protocol. <del> "validate", which takes as input: * an optional authenticator request * an authenticator </del>  It returns the certificate chain and extensions.

There are lots of changes here. I did stage this as separate commits to some extent, so feel free to cherry-pick. There is one maybe-technical change here. It wasn't clear about the precedence between handshake and authenticator request for extensions. I've chosen to be clear about this and say that if the authenticator request exists, then it is the only thing that matters. That's 8c0b166. I can drop that from the CL and do that separately if you prefer.
Thanks for the comments. The technical clarification you made is the correct one, the request supersedes the handshake for extension choices if present.

This message does not include the TLS record layer and is therefore not encrypted with a handshake key.  <ins> The CertificateRequest is used to define the parameters in a request for an authenticator.  The definition for TLS 1.3 is: </ins> An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  The but different parameters.  These messages do not include the TLS record layer and are therefore not encrypted with a handshake key. <ins> 4.1. </ins> Each authenticator is computed using a Handshake Context and Finished MAC Key derived from the TLS session.  These values are derived using an exporter as described in RFC5705 (for TLS 1.2) or TLS13 (for TLS computed with the extended master secret RFC7627 to avoid key synchronization attacks.  <ins> 4.2. An authenticator is formed from the concatenation of TLS 1.3 TLS13 Certificate, CertificateVerify, and Finished messages. If an authenticator request is present, the extensions used to guide the construction of these messages are taken from the authenticator request.  If there is no authenticator request, the extensions are chosen from the TLS handshake.  That is, the extensions received in a ClientHello (for servers), ServerHello (for clients in TLS 1.2), or EncryptedExtensions (for clients in TLS 1.3). 4.2.1. The certificate to be used for authentication and any supporting certificates in the chain.  This structure is defined in TLS13, Section 4.4.2. </ins> The certificate message contains an opaque string called certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is provided, it is zero-length.  <ins> The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version of TLS.  In particular, the certificate MUST be valid for the a signature algorithm indicated by the peer in a "signature_algorithms" extension, as described in Section 4.2.3 of TLS13 and Sections 7.4.2 and 7.4.6 of RFC5246. In addition to "signature_algorithms", the "server_name" RFC6066, "certificate_authorities" (Section 4.2.4. of TLS13), or "oid_filters" (Section 4.2.5. of TLS13) extensions are used to guide certificate selection.  These extensions are taken from the authenticator request if present, or the TLS handshake if not. Alternative certificate formats such as RFC7250 Raw Public Keys are not supported in this version of the specification. If an authenticator request was provided, the Certificate message MUST contain only extensions present in the authenticator request. Otherwise, the Certificate message MUST contain only extensions present in the TLS handshake. 4.2.2. This message is used to provide explicit proof that an endpoint possesses the private key corresponding to its certificate.  The definition for TLS 1.3 is: </ins> The algorithm field specifies the signature algorithm used (see Section 4.2.3 of TLS13 for the definition of this field).  The  <ins> signature is a digital signature using that algorithm. The signature scheme MUST be a valid signature scheme for TLS 1.3. This excludes all RSASSA-PKCS1-v1_5 algorithms and combinations of ECDSA and hash algorithms that are not supported in TLS 1.3. If an authenticator request is present, the signature algorithm MUST be chosen from one of the signature schemes in the authenticator request.  Otherwise, the signature algorithm used should be chosen from the "signature_algorithms" extension sent by the peer in the TLS handshake. </ins> The signature is computed using the over the concatenation of: A single 0 byte which serves as the separator  <ins> The hashed authenticator transcript </ins>  <ins> The authenticator transcript is the hash of the concatenated Handshake Context, authenticator request (if present), and Certificate message: </ins>  <ins> "Hash(Handshake Context || authenticator request || Certificate) " </ins>  <ins> Where Hash is the hash function negotiated by TLS.  If the authenticator request is not present, it is omitted from this construction (that is, it is zero length). </ins>  <ins> 4.2.3. </ins>  <ins> A HMAC HMAC over the hashed authenticator transcript, which is the concatenated Handshake Context, authenticator request, Certificate, and CertificateVerify: "Hash(Handshake Context || authenticator request || Certificate || CertificateVerify) " The HMAC is computed using the same hash function using the Finished MAC Key as a key. 4.2.4. An endpoint constructs an authenticator by concatenating serializing the Certificate, CertificateVerify, and Finished as TLS handshake messages and concatenating the octets: </ins>  <ins> "Certificate || CertificateVerify || Finished " </ins> A given authenticator can be validated by checking the validity of the CertificateVerify message given the authenticator request (if provide application programming interfaces by which clients and servers may request and verify exported authenticator messages.  <ins> Notwithstanding the success conditions described below, all APIs MUST fail if: </ins> the connection uses a TLS version of 1.1 or earlier, or the connection is TLS 1.2 and the extended master secret RFC7627 was not used  <ins> The following sections describes APIs that are considered necessary to implement exported authenticators.  These are informative only. </ins>  <ins> 5.1. The "request" API takes as input: </ins> certificate_request_context (from 0 to 255 bytes) It returns an authenticator request, which is a sequence of octets that includes a CertificateRequest message.  <ins> 5.2. The "get context" API takes as input: </ins> authenticator It returns the certificate_request_context.  <ins> 5.3. The "authenticate" takes as input: </ins> a set of certificate chains and associated extensions (OCSP, SCT, etc.) an optional authenticator request  <ins> It returns the exported authenticator as a sequence of octets.  It is RECOMMENDED that the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library.  Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. </ins> It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the application does not have access to a TLS library with these APIs or when TLS is handled independently of the application layer protocol.  <ins> 5.4. The "validate" API takes as input: an optional authenticator request an authenticator </ins> It returns the certificate chain and extensions.


The certificate message contains an opaque string called certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is <del> provided, it is zero-length. </del>  The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version a signer (either the private key associated with the certificate, or interface to perform private key operation) for each chain <del> an optional authenticator request </del>  It returns the exported authenticator as a sequence of octets.  It is RECOMMENDED that the logic for selecting the certificates and

Make it possible to choose a non-empty certificaterequestcontext when there is no authenticator request. This change introduces the flexibility needed to achieve compound authentication between certificates using a technique called CRC Smuggling, described by Jonathan Hoyland.

The certificate message contains an opaque string called certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is  <ins> provided, the certificate_request_context can be chosen arbitrarily. </ins> The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version a signer (either the private key associated with the certificate, or interface to perform private key operation) for each chain  <ins> an optional authenticator request or certificate_request_context (from 0 to 255 bytes) </ins> It returns the exported authenticator as a sequence of octets.  It is RECOMMENDED that the logic for selecting the certificates and


an optional authenticator request or certificate_request_context (from 0 to 255 bytes) <del> It returns the exported authenticator as a sequence of octets.  It is RECOMMENDED that the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library.  Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. </del>  It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the

It's also the only use of 2119 language in this section, which is otherwise nicely informative.

an optional authenticator request or certificate_request_context (from 0 to 255 bytes)  <ins> It returns the exported authenticator as a sequence of octets. Ideally, the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library. Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. </ins> It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the


An authenticator message can be constructed by either the client or the server given an established TLS connection, a certificate, and a <del> corresponding private key.  For clients, an authenticator request is required; for servers an authenticator request is optional.  The authenticator uses the message structures from Section 4.4 of TLS13, but different parameters.  These messages do not include the TLS record layer and are therefore not encrypted with a handshake key. </del>  4.1. If an authenticator request is present, the extensions used to guide the construction of these messages are taken from the authenticator request.  If there is no authenticator request, the extensions are <del> chosen from the TLS handshake.  That is, the extensions received in a ClientHello (for servers), ServerHello (for clients in TLS 1.2), or EncryptedExtensions (for clients in TLS 1.3). </del>  4.2.1.

In Section 4, clients are required to have an authenticator request before generating and sending an authenticator. Later, in Section 4.2, the draft states that clients may get authenticator information from a SH or EncryptedExtensions in the event that no authenticator request is present. This seems to contradict the requirement in Section 4.

An authenticator message can be constructed by either the client or the server given an established TLS connection, a certificate, and a  <ins> corresponding private key.  Clients MUST NOT send an authenticator without a preceding authenticator request; for servers an authenticator request is optional. The authenticator uses the message structures from Section 4.4 of TLS13, but different parameters.  These messages do not include the TLS record layer and are therefore not encrypted with a handshake key. </ins> 4.1. If an authenticator request is present, the extensions used to guide the construction of these messages are taken from the authenticator request.  If there is no authenticator request, the extensions are  <ins> chosen from the TLS handshake.  Only servers can provide an authenticator without a corresponding request.  In such cases, ClientHello extensions are used to determine permissible extensions in the Certificate message. </ins> 4.2.1.


5.  The creation and validation of both authenticator requests and authenticators SHOULD be implemented inside the TLS library even if it is possible to implement it at the application layer.  TLS The following sections describes APIs that are considered necessary to implement exported authenticators.  These are informative only. <del> 5.1. </del>  The "request" API takes as input: It returns an authenticator request, which is a sequence of octets that includes a CertificateRequest message. <del> 5.2. </del>  The "get context" API takes as input: It returns the certificate_request_context. <del> 5.3. </del>  The "authenticate" takes as input: an optional authenticator request or certificate_request_context (from 0 to 255 bytes) <del> It returns the exported authenticator as a sequence of octets. Ideally, the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library. Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. </del>  It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the application does not have access to a TLS library with these APIs or when TLS is handled independently of the application layer protocol. <del> 5.4. </del>  The "validate" API takes as input: an authenticator <del> It returns the certificate chain and extensions. </del>  <del> 6. </del>  This document has no IANA actions. <del> 7. </del>  The Certificate/Verify/Finished pattern intentionally looks like the TLS 1.3 pattern which now has been analyzed several times.  In the

URL you don't want to provide one. TLS allows Certificate to be empty, with a missing CertificateVerify and Finished as normal. That would be a nice change. Alternatively, we could insist on the using application managing this, but it seems like an authenticated refusal is nice.
Resolved in PR

5. <ins> If, given an authenticator request, the endpoint does have an appropriate certificate or does not want to return one, it constructs an authenticated refusal called an empty authenticator.  This is an HMAC over the hashed authenticator transcript with a Certificate message containing no CertificateEntries and the CertificateVerify message omitted: "Hash(Handshake Context || authenticator request || Certificate) " The HMAC is computed using the same hash function using the Finished MAC Key as a key. 6. </ins> The creation and validation of both authenticator requests and authenticators SHOULD be implemented inside the TLS library even if it is possible to implement it at the application layer.  TLS The following sections describes APIs that are considered necessary to implement exported authenticators.  These are informative only.  <ins> 6.1. </ins> The "request" API takes as input: It returns an authenticator request, which is a sequence of octets that includes a CertificateRequest message.  <ins> 6.2. </ins> The "get context" API takes as input: It returns the certificate_request_context.  <ins> 6.3. </ins> The "authenticate" takes as input: an optional authenticator request or certificate_request_context (from 0 to 255 bytes)  <ins> It returns either the exported authenticator or an empty authenticator as a sequence of octets.  It is RECOMMENDED that the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library.  Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. </ins> It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the application does not have access to a TLS library with these APIs or when TLS is handled independently of the application layer protocol.  <ins> 6.4. </ins> The "validate" API takes as input: an authenticator  <ins> It returns the certificate chain and extensions and a status to indicate whether the authenticator is valid or not.  If the authenticator was empty - that is, it did not contain a certificate - the certificate chain will contain no certificates. </ins>  <ins> 7. </ins> This document has no IANA actions.  <ins> 8. </ins> The Certificate/Verify/Finished pattern intentionally looks like the TLS 1.3 pattern which now has been analyzed several times.  In the


the server given an established TLS connection, a certificate, and a corresponding private key.  Clients MUST NOT send an authenticator without a preceding authenticator request; for servers an <del> authenticator request is optional. The authenticator uses the message structures from Section 4.4 of TLS13, but different parameters.  These messages do not include the TLS record layer and are therefore not encrypted with a handshake key. </del>  4.1.

the newline was being introduced by trailing whitespace at the end of line 136.
In the , there's a newline between two sentences that apparently can't decide whether they want to be in separate paragraphs or not.

the server given an established TLS connection, a certificate, and a corresponding private key.  Clients MUST NOT send an authenticator without a preceding authenticator request; for servers an  <ins> authenticator request is optional.  The authenticator uses the message structures from Section 4.4 of TLS13, but different parameters.  These messages do not include the TLS record layer and are therefore not encrypted with a handshake key. </ins> 4.1.


An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  A <del> certificate_request_context value MUST NOT be repeated for multiple authenticator requests generated by the same party within the scope of a connection (thus preventing replay of authenticators).  The certificate_request_context SHOULD be chosen to be unpredictable to the peer (e.g., by randomly generating it) in order to prevent an attacker who has temporary access to the peer's private key from pre-computing valid authenticators.  This value is unrelated to the certificate_request_context used in post-handshake authentication and collisions do not need to be avoided. </del>  The extensions that are allowed in this structure include the extensions defined for CertificateRequest messages defined in If an authenticator request is present, the extensions used to guide the construction of these messages are taken from the authenticator <del> request.  If there is no authenticator request, the extensions are chosen from the TLS handshake.  Only servers can provide an authenticator without a corresponding request.  In such cases, ClientHello extensions are used to determine permissible extensions in the Certificate message. </del>  4.2.1. The certificate message contains an opaque string called certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is <del> provided, the certificate_request_context can be chosen arbitrarily. </del>  The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version

NAME The crc can be derived in two places: the authenticator request and the unsolicited authenticator. I want to make sure the requirement is clear in both places.
Issue raised by Jonathan Hoyland at IETF 102
So you just wanted to repeat the requirement? Because that first bit already said no repeats.

An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  A  <ins> certificate_request_context value MUST be unique for each authenticator request within the scope of a connection (preventing replay and context confusion).  The certificate_request_context SHOULD be chosen to be unpredictable to the peer (e.g., by randomly generating it) in order to prevent an attacker who has temporary access to the peer's private key from pre-computing valid authenticators.  This value is unrelated to the certificate_request_context used in post-handshake authentication and collisions do not need to be avoided. </ins> The extensions that are allowed in this structure include the extensions defined for CertificateRequest messages defined in If an authenticator request is present, the extensions used to guide the construction of these messages are taken from the authenticator  <ins> request.  If the certificate_request_context from the authenticator request has already been used in the connection, then no authenticator should be constructed.  If there is no authenticator request, the extensions are chosen from the TLS handshake.  Only servers can provide an authenticator without a corresponding request. In such cases, ClientHello extensions are used to determine permissible extensions in the Certificate message. </ins> 4.2.1. The certificate message contains an opaque string called certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is  <ins> provided, the certificate_request_context can be chosen arbitrarily but MUST be unique within the scope of the connection and be unpredictable to the peer. </ins> The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version


The "get context" API takes as input: <del> authenticator </del>  It returns the certificate_request_context.

In the HTTPbis meeting in Montreal, it was suggested that recipients of a frame should validate that the claimed Request-ID matched the in the supplied authenticator request. However, the document defines no API which would permit us to do that.
Shouldn't this be implemented at the HTTP layer using the "get context" API? This document is not prescriptive about the content of the crc except that it is unpredictable and unique.
allows us to extract it from an authenticator, but doesn't allow performing the same operation on a request.
Good point. This should be a simple addition.
URL

The "get context" API takes as input:  <ins> authenticator or authenticator request </ins> It returns the certificate_request_context.


1. This document provides a way to authenticate one party of a Transport <del> Layer Security (TLS) communication to its peer using a certificate after the session has been established.  This allows both the client and server to prove ownership of additional identities at any time after the handshake has completed.  This proof of authentication can be exported and transmitted out of band from one party to be validated by its peer. </del>  This mechanism provides two advantages over the authentication that TLS natively provides: connection protocols like HTTP/2 RFC7540 do not have a notion of which TLS record a given message is a part of. <del> For simplicity, the mechanisms described in this document require a TLS version 1.2 or later. </del>  2. by either party of a TLS connection using data exported from that connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The application layer protocol <del> used to send the authenticator SHOULD use TLS as its underlying transport to keep the request confidential. </del>  An authenticator request message can be constructed by either the client or the server.  This authenticator request uses the party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use TLS as its underlying transport to keep the certificate confidential.  An authenticator message can be constructed by either the client or the server given an established TLS connection, a certificate, and a 4.1. Each authenticator is computed using a Handshake Context and Finished <del> MAC Key derived from the TLS session.  These values are derived using an exporter as described in RFC5705 (for TLS 1.2) or TLS13 (for TLS 1.3).  These values use different labels depending on the role of the sender: </del>  The Handshake Context is an exporter value that is derived using the label "EXPORTER-client authenticator handshake context" or

NAME are you happy with the adjusted text? I don't consider DTLS support to be a big change since the only thing we are relying on from TLS is the exporter interface.
I think that this is sneaking in a big change with the DTLS thing. I'll try to find the email...

1. This document provides a way to authenticate one party of a Transport  <ins> Layer Security (TLS) connection to its peer using a certificate after the session has been established.  This allows both the client and server to prove ownership of additional identities at any time after the handshake has completed.  This proof of authentication can be exported and transmitted out-of-band from one party to be validated by its peer. </ins> This mechanism provides two advantages over the authentication that TLS natively provides: connection protocols like HTTP/2 RFC7540 do not have a notion of which TLS record a given message is a part of.  <ins> Exported Authenticators are meant to be used as a building block for application protocols.  Mechanisms such as those required to advertise support and handle authentication errors are not handled at the TLS layer. For simplicity, the mechanisms described in this document require TLS (or DTLS) version 1.2 or later. </ins> 2. by either party of a TLS connection using data exported from that connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The application layer protocol  <ins> used to send the authenticator request SHOULD use TLS as its underlying transport to keep the request confidential.  The application MAY use the existing TLS connection to transport the authenticator. </ins> An authenticator request message can be constructed by either the client or the server.  This authenticator request uses the party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use TLS as its underlying transport to keep the certificate confidential. <ins> The application MAY use the existing TLS connection to transport the authenticator. </ins> An authenticator message can be constructed by either the client or the server given an established TLS connection, a certificate, and a 4.1. Each authenticator is computed using a Handshake Context and Finished  <ins> MAC Key derived from the TLS connection.  These values are derived using an exporter as described in RFC5705 (for TLS 1.2) or TLS13 (for TLS 1.3).  These values use different labels depending on the role of the sender: </ins> The Handshake Context is an exporter value that is derived using the label "EXPORTER-client authenticator handshake context" or


authenticator. An authenticator request message can be constructed by either the <del> client or the server.  This authenticator request uses the CertificateRequest message structure from Section 4.3.2 of TLS13, even if the TLS connection protocol is TLS 1.2.  The CertificateRequest is used to define the parameters in a request for an authenticator.  This message does not include any TLS framing and is not encrypted with a handshake key. </del>  <del> The uniqueness requirements of the certificate_request_context apply only to CertificateRequest messages that are used as part of authenticator requests.  There is no impact if the value of a certificate_request_context used in an authenticator request matches the value of a certificate_request_context in the handshake or in a post-handshake message.  The structure is defined to be: </del>  An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  A temporary access to the peer's private key from pre-computing valid authenticators. <del> The extensions that are allowed in this structure include the extensions defined for CertificateRequest messages defined in Section 4.2. of TLS13 and the server_name RFC6066 extension, which is allowed for client-generated authenticator requests. </del>  5. either party of a TLS connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use <del> TLS as its underlying transport to keep the certificate confidential. The application MAY use the existing TLS connection to transport the </del>  authenticator. An authenticator message can be constructed by either the client or signature_algorithms) It returns an authenticator request, which is a sequence of octets <del> that comprises a CertificateRequest message. </del>  7.2.

A reference QUIC would also need to be added to the references section If it's an informative draft maybe not a thing, but if it's a normative reference then this draft will sit in the queue until QUIC transport gets published. Maybe that's okay, but just an FYI.
I may be missing some follow-on discussions, but: Ben suggested that we mention that QUIC is also an option, even if informatively, in addition to the “SHOULD use TLS” statement. I think we left my question re: back-fitting this protocol into the IANA TLS registry open. Quoting: YS: 7.1: this is changing TLS 1.3 by allowing this extension in Cert Request! I think it's a really bad idea. Better to hack special support to existing libraries, allowing this specific extension for this special case, than to change the base protocol. Otherwise, this document should UPDATE 8446. NS: This is a good point and one that we struggled a bit with during design. We needed to allow SNI in the CertificateRequest message because it can be client-generated in this context. I'd be ok with creating a different extension for this, but it's rather elegant to re-use it in this context. I'd like to hear some opinions from the working group on this point BK: Or, since extension codepoints are cheap, just use a new codepoint.
Addressed by .

authenticator. An authenticator request message can be constructed by either the  <ins> client or the server.  Server-generated authenticator requests use the CertificateRequest message from Section 4.3.2 of TLS13.  Client- generated authenticator requests use a new message, called the ClientCertificateRequest, which uses the same structure as CertificateRequest.  These messages structures are used even if the TLS connection protocol is TLS 1.2. </ins>  <ins> The CertificateRequest and ClientCertificateRequest messages are used to define the parameters in a request for an authenticator.  These messages do not include any TLS framing and are not encrypted with a handshake key. The structures are defined to be: </ins> An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  A temporary access to the peer's private key from pre-computing valid authenticators.  <ins> The set of extensions allowed in the CertificateRequest structure are those defined in the TLS ExtensionType Values IANA registry containing CR in the TLS 1.3 column.  The extensions allowed in the ClientCertificateRequest are those containing CR in the TLS 1.3 column, along with the server_name RFC6066 extension. The uniqueness requirements of the certificate_request_context apply only to CertificateRequest and ClientCertificateRequest messages that are used as part of authenticator requests.  There is no impact if the value of a certificate_request_context used in an authenticator request matches the value of a certificate_request_context in the handshake or in a post-handshake message. </ins> 5. either party of a TLS connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use  <ins> TLS or a protocol with comparable security properties as its underlying transport to keep the certificate confidential.  The application MAY use the existing TLS connection to transport the </ins> authenticator. An authenticator message can be constructed by either the client or signature_algorithms) It returns an authenticator request, which is a sequence of octets  <ins> that comprises a CertificateRequest or ClientCertificateRequest message. </ins> 7.2.


The CertificateRequest and ClientCertificateRequest messages are used to define the parameters in a request for an authenticator.  These <del> messages do not include any TLS framing and are not encrypted with a handshake key. </del>  The structures are defined to be: hash is referred to as the authenticator hash. To avoid key synchronization attacks, Exported Authenticators MUST <del> NOT be generated or accepted on TLS 1.2 connectons that did not </del>  negotiate the extended master secret RFC7627. 5.2. An authenticator is formed from the concatenation of TLS 1.3 TLS13 <del> Certificate, CertificateVerify, and Finished messages. </del>  If the peer creating the certificate_request_context has already created or correctly validated an authenticator with the same value, a Certificate message containing no CertificateEntries and the CertificateVerify message omitted.  The HMAC is computed using the authenticator hash, using the Finished MAC Key as a key.  This <del> message does not include any TLS framing. </del>  7.

Proposal to fix Issue
cc NAME
The Introduction limits this to TLS 1.2 and later, but DTLS is similar. Do you want to take that into account now, or ignore it? DTLS has additional fields to support fragmentation: URL URL
Exported authentication are meant to be embedded in a higher-layer protocol, so there's no need to support fragmentation.
The draft states that there should be no "TLS framing" but what is meant is that the handshake messages shouldn't be encapsulated by TLS Record Framing (which does the encryption of the handshake messages).

The CertificateRequest and ClientCertificateRequest messages are used to define the parameters in a request for an authenticator.  These  <ins> are encoded as TLS handshake messages, including length and type fields.  They do not include any TLS record layer framing and are not encrypted with a handshake key. </ins> The structures are defined to be: hash is referred to as the authenticator hash. To avoid key synchronization attacks, Exported Authenticators MUST  <ins> NOT be generated or accepted on TLS 1.2 connections that did not </ins> negotiate the extended master secret RFC7627. 5.2. An authenticator is formed from the concatenation of TLS 1.3 TLS13  <ins> Certificate, CertificateVerify, and Finished messages.  These messages are encoded as TLS handshake messages, including length and type fields. </ins> If the peer creating the certificate_request_context has already created or correctly validated an authenticator with the same value, a Certificate message containing no CertificateEntries and the CertificateVerify message omitted.  The HMAC is computed using the authenticator hash, using the Finished MAC Key as a key.  This  <ins> message is encoded as a TLS handshake message, including length and type field.  It does not include TLS record layer framing. </ins> 7.


Abstract This document describes a mechanism in Transport Layer Security (TLS) <del> for peers to provide a proof of ownership of a certificate.  This proof can be exported by one peer, transmitted out-of-band to the other peer, and verified by the receiving peer. </del>  1. This document provides a way to authenticate one party of a Transport <del> Layer Security (TLS) connection to its peer using a certificate after the session has been established.  This allows both the client and server to prove ownership of additional identities at any time after the handshake has completed.  This proof of authentication can be exported and transmitted out-of-band from one party to be validated by its peer. </del>  This mechanism provides two advantages over the authentication that TLS natively provides: party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use TLS or a protocol with comparable security properties as its <del> underlying transport to keep the certificate confidential.  The </del>  application MAY use the existing TLS connection to transport the authenticator. An authenticator message can be constructed by either the client or <del> the server given an established TLS connection, a certificate, and a corresponding private key.  Clients MUST NOT send an authenticator without a preceding authenticator request; for servers an authenticator request is optional.  For authenticators that do not correspond to authenticator requests, the certificate_request_context is chosen by the server. </del>  5.1. 5.2.1. <del> The Certificate message contains the certificate to be used for authentication and any supporting certificates in the chain.  This structure is defined in TLS13, Section 4.4.2. </del>  <del> The certificate message contains an opaque string called </del>  certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is provided, the certificate_request_context can be chosen arbitrarily but MUST be unique within the scope of the connection and be unpredictable to the peer. <del> The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version of TLS.  In particular, the certificate chain MUST be valid for the a </del>  signature algorithms indicated by the peer in the "signature_algorithms" and "signature_algorithms_cert" extension, as described in Section 4.2.3 of TLS13 for TLS 1.3 or the 5.2.2. This message is used to provide explicit proof that an endpoint <del> possesses the private key corresponding to its certificate.  The </del>  definition for TLS 1.3 is: The algorithm field specifies the signature algorithm used (see Where Hash is the authenticator hash defined in section 4.1.  If the authenticator request is not present, it is omitted from this <del> construction (that is, it is zero length). </del>  If the party that generates the exported authenticator does so with a different connection than the party that is validating it, then the 6. If, given an authenticator request, the endpoint does not have an <del> appropriate certificate or does not want to return one, it constructs an authenticated refusal called an empty authenticator.  This is a </del>  Finished message sent without a Certificate or CertificateVerify. This message is an HMAC over the hashed authenticator transcript with a Certificate message containing no CertificateEntries and the a reference to an active connection <del> a set of certificate chains and associated extensions (OCSP, SCT, etc.) </del>  <del> a signer (either the private key associated with the certificate, or interface to perform private key operations) for each chain </del>  an authenticator request or certificate_request_context (from 0 to 255 bytes) an authenticator <del> It returns the certificate chain and extensions and a status to indicate whether the authenticator is valid or not.  If the authenticator was empty - that is, it did not contain a certificate - the certificate chain will contain no certificates.  The API SHOULD return a failure if the certificate_request_context of the authenticator was used in a previously validated authenticator. Well-formed empty authenticators are returned as valid. </del>  8. certificate_request_context. This property makes it difficult to formally prove that a server <del> is jointly authoritative over multiple certificates, rather than </del>  individually authoritative over each. There is no indication in the TLS layer about which point in time

This changes a lot of text, since many places (perhaps rightfully so) assume the contents of the Certificate message are a normal X509 certificate. Some uses of EAs might just use the Certificate message as a vehicle for other identifying information. Thus, rather than box ourselves into a corner, this change generalizes the purpose of this Certificate to be that of an identity. Addresses .
The document's currently written in such a way that one might assume it can only be used to authenticate additional certificates. For example, the introduction states: (emphasis mine!) However, [1] suggests that other authentication mechanisms are possible. (Meta observation and question: what are the contents of the Authenticator messages in the OPAQUE EA flow? Section 6 discusses the possibility of an empty Authenticator, but the OPAQUE flow uses the extension to provide the server response. What OPAQUE seems to require is an empty but non-empty .) Perhaps we should generalize certificate-based authentication to arbitrary challenge-response authentication mechanisms? [1] URL
cc NAME

Abstract This document describes a mechanism in Transport Layer Security (TLS)  <ins> for peers to provide a proof of ownership of an identity, such as an X509 certificate.  This proof can be exported by one peer, transmitted out-of-band to the other peer, and verified by the receiving peer. </ins> 1. This document provides a way to authenticate one party of a Transport  <ins> Layer Security (TLS) connection to its peer using a Certificate message after the session has been established.  This allows both the client and server to prove ownership of additional identities at any time after the handshake has completed.  This proof of authentication can be exported and transmitted out-of-band from one party to be validated by its peer. </ins> This mechanism provides two advantages over the authentication that TLS natively provides: party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use TLS or a protocol with comparable security properties as its  <ins> underlying transport to keep the Certificate confidential.  The </ins> application MAY use the existing TLS connection to transport the authenticator. An authenticator message can be constructed by either the client or  <ins> the server given an established TLS connection, an identity, such as an X509 certificate, and a corresponding private key.  Clients MUST NOT send an authenticator without a preceding authenticator request; for servers an authenticator request is optional.  For authenticators that do not correspond to authenticator requests, the certificate_request_context is chosen by the server. </ins> 5.1. 5.2.1.  <ins> The Certificate message contains the identity to be used for authentication, such as the end-entity certificate and any supporting certificates in the chain.  This structure is defined in TLS13, Section 4.4.2. </ins>  <ins> The Certificate message contains an opaque string called </ins> certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is provided, the certificate_request_context can be chosen arbitrarily but MUST be unique within the scope of the connection and be unpredictable to the peer.  <ins> Certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the negotiated version of TLS.  In particular, the certificate chain MUST be valid for the a </ins> signature algorithms indicated by the peer in the "signature_algorithms" and "signature_algorithms_cert" extension, as described in Section 4.2.3 of TLS13 for TLS 1.3 or the 5.2.2. This message is used to provide explicit proof that an endpoint  <ins> possesses the private key corresponding to its identity.  The </ins> definition for TLS 1.3 is: The algorithm field specifies the signature algorithm used (see Where Hash is the authenticator hash defined in section 4.1.  If the authenticator request is not present, it is omitted from this  <ins> construction, i.e., it is zero length. </ins> If the party that generates the exported authenticator does so with a different connection than the party that is validating it, then the 6. If, given an authenticator request, the endpoint does not have an  <ins> appropriate identity or does not want to return one, it constructs an authenticated refusal called an empty authenticator.  This is a </ins> Finished message sent without a Certificate or CertificateVerify. This message is an HMAC over the hashed authenticator transcript with a Certificate message containing no CertificateEntries and the a reference to an active connection  <ins> an identity, such as a set of certificate chains and associated extensions (OCSP, SCT, etc.) </ins>  <ins> a signer (either the private key associated with the identity, or interface to perform private key operations) for each chain </ins> an authenticator request or certificate_request_context (from 0 to 255 bytes) an authenticator  <ins> It returns the identity, such as the certificate chain and its extensions, and a status to indicate whether the authenticator is valid or not.  The API SHOULD return a failure if the certificate_request_context of the authenticator was used in a previously validated authenticator.  Well-formed empty authenticators are returned as valid. </ins> 8. certificate_request_context. This property makes it difficult to formally prove that a server  <ins> is jointly authoritative over multiple identities, rather than </ins> individually authoritative over each. There is no indication in the TLS layer about which point in time


This document describes a mechanism in Transport Layer Security (TLS) for peers to provide a proof of ownership of an identity, such as an <del> X509 certificate.  This proof can be exported by one peer, </del>  transmitted out-of-band to the other peer, and verified by the receiving peer. An authenticator message can be constructed by either the client or the server given an established TLS connection, an identity, such as <del> an X509 certificate, and a corresponding private key.  Clients MUST </del>  NOT send an authenticator without a preceding authenticator request; for servers an authenticator request is optional.  For authenticators that do not correspond to authenticator requests, the "oid_filters" (Section 4.2.5. of TLS13) extensions are used to guide certificate selection. <del> Only the X509 certificate type defined in TLS13 is supported. </del>  Alternative certificate formats such as RFC7250 Raw Public Keys are not supported in this version of the specification and their use in this context has not yet been analysed. Where Hash is the authenticator hash defined in section 4.1.  If the authenticator request is not present, it is omitted from this <del> construction, i.e., it is zero length. </del>  If the party that generates the exported authenticator does so with a different connection than the party that is validating it, then the

got merged while I was reviewing it, so here's my feedback as a follow-up PR. I initially though line 244 needed a comma, but usage through the rest of the document suggests that supporting certificates are a property of one type of identity instead of something that could come along with a generic identity, so I dropped that one.
Thanks, Mike.

This document describes a mechanism in Transport Layer Security (TLS) for peers to provide a proof of ownership of an identity, such as an  <ins> X.509 certificate.  This proof can be exported by one peer, </ins> transmitted out-of-band to the other peer, and verified by the receiving peer. An authenticator message can be constructed by either the client or the server given an established TLS connection, an identity, such as  <ins> an X.509 certificate, and a corresponding private key.  Clients MUST </ins> NOT send an authenticator without a preceding authenticator request; for servers an authenticator request is optional.  For authenticators that do not correspond to authenticator requests, the "oid_filters" (Section 4.2.5. of TLS13) extensions are used to guide certificate selection.  <ins> Only the X.509 certificate type defined in TLS13 is supported. </ins> Alternative certificate formats such as RFC7250 Raw Public Keys are not supported in this version of the specification and their use in this context has not yet been analysed. Where Hash is the authenticator hash defined in section 4.1.  If the authenticator request is not present, it is omitted from this  <ins> construction, i.e., it is zero-length. </ins> If the party that generates the exported authenticator does so with a different connection than the party that is validating it, then the


an authenticator  It returns the identity, such as the certificate chain and its extensions, and a status to indicate whether the authenticator is <del> valid or not.  The API SHOULD return a failure if the certificate_request_context of the authenticator was used in a previously validated authenticator.  Well-formed empty authenticators are returned as valid. </del>  8.

one minor nit: i would phrase "applying the function for validating the certificate chain contained in the authenticator." as "applying the function for validating the certificate chain to the chain contained in the authenticator." for clarity. Otherwise LGTM!
I've implemented earlier drafts. I do have a concern with the validate API as presented in the draft: it treats empty authenticators as valid, and then returns the identity as a certificate chain that must be validated by the application. Similar APIs have lead to easily foreseeable pwnage. Instead I would recommend the validate API carry out X509 validation against a trust store or validation function and treat the empty authenticator as invalid. That way someone has to think before not checking the certificate returned.
Closing this out as it was addressed.

an authenticator <ins> a function for validating a certificate chain </ins> It returns the identity, such as the certificate chain and its extensions, and a status to indicate whether the authenticator is  <ins> valid or not after applying the function for validating the certificate chain to the chain contained in the authenticator. The API SHOULD return a failure if the certificate_request_context of the authenticator was used in a previously validated authenticator. Well-formed empty authenticators are returned as invalid. </ins> 8.


valid authenticators. The set of extensions allowed in the CertificateRequest structure <del> are those defined in the TLS ExtensionType Values IANA registry containing CR in the TLS 1.3 column.  The extensions allowed in the ClientCertificateRequest are those containing CR in the TLS 1.3 column, along with the server_name RFC6066 extension. </del>  The uniqueness requirements of the certificate_request_context apply only to CertificateRequest and ClientCertificateRequest messages that

Section 4: I find this confusing: extensions: The set of extensions allowed in the CertificateRequest structure are those defined in the TLS ExtensionType Values IANA registry containing CR in the TLS 1.3 column. The extensions allowed in the ClientCertificateRequest are those containing CR in the TLS 1.3 column, along with the servername [RFC6066] extension. I think it means: extensions: The set of extensions allowed in the CertificateRequest structure and the ClientCertificateRequest structure are those defined in the TLS ExtensionType Values IANA registry [cite] containing CR in the TLS 1.3 column. In addition, the set of extensions in the ClientCertificateRequest structure MAY include the servername [RFC6066] extension.
fixed in

valid authenticators. The set of extensions allowed in the CertificateRequest structure  <ins> and the ClientCertificateRequest structure are those defined in the TLS ExtensionType Values IANA registry RFC8447 containing CR in the TLS 1.3 column.  In addition, the set of extensions in the ClientCertificateRequest structure MAY include the server_name RFC6066 extension. </ins> The uniqueness requirements of the certificate_request_context apply only to CertificateRequest and ClientCertificateRequest messages that


authenticator finished key" with "DTLS-OK" and "Recommended" set to "Y" and this document added to the "Reference" column.  9. The Certificate/Verify/Finished pattern intentionally looks like the

Hmmm maybe it should be "clientcertificaterequest" to match the other values in the Description column.
If ClientCertificateRequest is a new HandshakeType then there needs to be a registry request. If is adopted will need to also request one for ServerCertificateRequest.

authenticator finished key" with "DTLS-OK" and "Recommended" set to "Y" and this document added to the "Reference" column. <ins> 8.3. IANA is requested to add the following entry to the registry for HandshakeType (defined in RFC8446): "client_certificate_request" with "DTLS-OK" and "Recommended" set to "Y" and this document added to the "Reference" column with the following in the "Note" column: "Used in TLS versions prior to 1.3." </ins> 9. The Certificate/Verify/Finished pattern intentionally looks like the


3.  The authenticator is a structured message that can be exported from either party of a TLS connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The An authenticator message can be constructed by either the client or the server given an established TLS connection, a certificate, and a <del> corresponding private key.  This authenticator uses the message structures from Section 4.4 of TLS13, but different parameters. Also, unlike the Certificate and CertificateRequest messages in TLS 1.3, the messages described in this draft are not encrypted with a handshake key. </del>  Each authenticator is computed using a Handshake Context and Finished MAC Key derived from the TLS session.  These values are derived using Section 4.4.2. The certificate message contains an opaque string called <del> certificate_request_context.  The format of certificate_request_context is defined by the application layer protocol and its value can be used to differentiate exported authenticators.  For example, the application may use a sequence number used by the higher-level protocol during the transport of the authenticator to the other party.  Using a unique and unpredictable value ties the authenticator to a given context, allowing the application to prevent authenticators from being replayed or precomputed by an attacker with temporary access to a private key. </del>  This message is used to provide explicit proof that an endpoint possesses the private key corresponding to its certificate. signature is a digital signature using that algorithm.  The signature scheme MUST be a valid signature scheme for TLS 1.3.  This excludes all RSASSA-PKCS1-v1_5 algorithms and ECDSA algorithms that are not <del> supported in TLS 1.3.  For servers, this signature scheme must match one of the signature and hash algorithms advertised in the signature_algorithms extension of the ClientHello.  The signature is computed using the over the concatenation of: </del>  A string that consists of octet 32 (0x20) repeated 64 times A single 0 byte which serves as the separator <del> The value Hash(Handshake Context || Certificate) where Hash is the hash function for the handshake. </del>  A HMAC over the value Hash(Handshake Context || Certificate ||  CertificateVerify) where Hash is the hash function for the handshake, and the HMAC is computed using the hash function from the handshake and the Finished MAC Key as a key. <del> The certificates used in the Certificate message MUST conform to the requirements of a Certificate message in the version of TLS negotiated.  This is described in Section 4.2.3 of TLS13 and Sections </del>  7.4.2 and 7.4.6 of RFC5246.  Alternative certificate formats such as <del> RFC7250 Raw Public Keys are not supported. The exported authenticator message is the concatenation of messages: </del>  Certificate || CertificateVerify || Finished <del> A given exported authenticator can be validated by checking the validity of the CertificateVerify message and recomputing the Finished message to see if it matches. </del>  <del> 4. </del>  <del> The creation and validation of exported authenticators SHOULD be implemented inside TLS library even if it is possible to implement it at the application layer.  TLS implementations supporting the use of exported authenticators MUST provide application programming interfaces by which clients and servers may request and verify exported authenticator messages. </del>  Given an established connection, the application SHOULD be able to <del> call an "authenticate" API which takes as input: </del>  certificate_request_context (from 0 to 255 bytes) <del> valid certificate chain for the connection and associated extensions (OCSP, SCT, etc.) </del>  <del> signer (either the private key associated with the certificate, or interface to perform private key operation) </del>  <del> signature scheme </del>  <del> The API returns the exported authenticator as output. </del>  <del> Given an established connection and an exported authenticator message, the application SHOULD be able to call a "validate" API that takes an exported authenticator as an input.  If the Finished and CertificateVerify messages verify correctly, the API returns the following as output: </del>  <del> certificate chain and extensions </del>  <del> certificate_request_context </del>  <del> In order for the application layer to be able to choose the certificates and signature schemes to use when constructing an authenticator, a TLS server SHOULD expose an API that returns the content of the signature_algorithms extension of client's ClientHello message. </del>  <del> 5. </del>  <del> This document has no IANA actions. </del>  6.  The Certificate/Verify/Finished pattern intentionally looks like the TLS 1.3 pattern which now has been analyzed several times.  In the case where the client presents an authenticator to a server, SIGMAC

Add new "authenticator request" message Make Certificate selection more explicit (including extensions) Update API considerations accordingly
I update the draft in response to the comments.
Two small comments: Can you add text explaining why authenticator requests are not encrypted with handshake keys? (Are they encrypted at all?) It might help to include a sequence diagram or two showing intended uses of exported authenticators, e.g., for Mike's draft, and where requests fit into TLS connections.
NAME I'm not sure what purpose encrypting them would serve. The draft does say that "The application layer protocol used to send the authenticator SHOULD use TLS as its underlying transport." In other words, the messages have integrity built-in and any desire for confidentiality is the app's to solve.
NAME I was referring to the following sentence: "This message is not encrypted with a handshake key, which differs from how this message is used in TLS 1.3." Perhaps you could add text explaining why this choice was made?
By the time you use this, handshake keys might be long gone. I think that we could avoid this confusion by stating that this is only the handshake messages and not records that form the authenticator. And maybe add that because there are no records, there is no record protection.

3. <ins> The authenticator request is a structured message that can be exported from either party of a TLS connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The application layer protocol used to send the authenticator SHOULD use TLS as its underlying transport. An authenticator request message can be constructed by either the client or the server.  This authenticator uses the CertificateRequest message structure from Section 4.3.2 of TLS13.  This message is not encrypted with a handshake key, which differs from how this message is used in TLS 1.3. This message is used to define the parameters in a request for an authenticator. An opaque string which identifies the certificate request and which will be echoed in the authenticator message.  The certificate_request_context MUST be unique within the scope of this connection (thus preventing replay of authenticators).  The certificate_request_context SHOULD be chosen to be unpredictable to the peer (e.g., by randomly generating it) in order to prevent an attacker who has temporary access to the peer's private key from pre-computing valid authenticators. The extensions that are allowed in this structure include the extensions defined for CertificateRequest messages defined in Section 4.2. of TLS13 and the server_name RFC6066 extension, which is allowed for client-generated authenticator requests. 4. </ins> The authenticator is a structured message that can be exported from either party of a TLS connection.  It can be transmitted to the other party of the TLS connection at the application layer.  The An authenticator message can be constructed by either the client or the server given an established TLS connection, a certificate, and a  <ins> corresponding private key.  For clients, an authenticator request is required; for servers an authenticator request is optional.  The authenticator uses the message structures from Section 4.4 of TLS13, but different parameters.  Unlike the Certificate and CertificateVerify messages in TLS 1.3, the messages described in this document are not encrypted with a handshake key. </ins> Each authenticator is computed using a Handshake Context and Finished MAC Key derived from the TLS session.  These values are derived using Section 4.4.2. The certificate message contains an opaque string called  <ins> certificate_request_context, which is extracted from the authenticator request if present.  If no authenticator request is provided, it is zero-length. </ins> This message is used to provide explicit proof that an endpoint possesses the private key corresponding to its certificate. signature is a digital signature using that algorithm.  The signature scheme MUST be a valid signature scheme for TLS 1.3.  This excludes all RSASSA-PKCS1-v1_5 algorithms and ECDSA algorithms that are not  <ins> supported in TLS 1.3.  If an authenticator request is present, the signature algorithm MUST be chosen from one of the signature schemes in the authenticator request.  Otherwise, the signature algorithm used should be chosen from the "signature_algorithms" extension of the ClientHello used in the connection handshake. The signature is computed using the over the concatenation of: </ins> A string that consists of octet 32 (0x20) repeated 64 times A single 0 byte which serves as the separator  <ins> If the authenticator request is present, the value "Hash(Handshake Context || authenticator request || Certificate)" If an authenticator request is not present, the value "Hash(Handshake Context || Certificate)" where Hash is the hash function for the handshake. </ins> A HMAC over the value Hash(Handshake Context || Certificate || <ins> CertificateVerify) if an authenticator is present, or Hash(Handshake Context || authenticator request || Certificate || </ins> CertificateVerify) where Hash is the hash function for the handshake, and the HMAC is computed using the hash function from the handshake and the Finished MAC Key as a key.  <ins> The certificates chosen in the Certificate message MUST conform to the requirements of a Certificate message in the version of TLS negotiated.  If an authenticator request is present, the signature algorithms used to choose the algorithm are taken from the "signature_algorithms" in the from the authenticator.  If there is no authenticator request, the signature algorithms are chosen from the "signature_algorithms" extension from the ClientHello used in the connection.  This is described in Section 4.2.3 of TLS13 and Sections </ins> 7.4.2 and 7.4.6 of RFC5246.  Alternative certificate formats such as  <ins> RFC7250 Raw Public Keys are not supported.  The "server_name" RFC6066, "certificate_authorities" (Section 4.2.4. of TLS13), or "oid_filters" (Section 4.2.5. of TLS13) extensions are used to guide certificate selection, with the extensions provided in the authenticator request taking precedence over the extensions provided in the connection handshake. If an authenticator request was provided, the Certificate message MUST contain only extensions present in the authenticator request. Otherwise, the Certificate message MUST contain only extensions present in the ClientHello. The authenticator message is the concatenation of messages: </ins> Certificate || CertificateVerify || Finished  <ins> A given authenticator can be validated by checking the validity of the CertificateVerify message given the authenticator request (if used) and recomputing the Finished message to see if it matches. </ins>  <ins> 5. </ins>  <ins> The creation and validation of both authenticator requests and authenticators SHOULD be implemented inside the TLS library even if it is possible to implement it at the application layer.  TLS implementations supporting the use of exported authenticators MUST provide application programming interfaces by which clients and servers may request and verify exported authenticator messages. </ins> Given an established connection, the application SHOULD be able to  <ins> call the following APIs: "request", which takes as input: </ins> certificate_request_context (from 0 to 255 bytes)  <ins> set of extensions to include (this MUST include signature_algorithms) </ins>  <ins> It returns an authenticator request, which is a sequence of octets that includes a CertificateRequest message. </ins>  <ins> "get context", which takes as input </ins>  <ins> authenticator </ins>  <ins> It returns the certificate_request_context. </ins>  <ins> "authenticate", which takes as input: </ins>  <ins> a set of certificate chains and associated extensions (OCSP, SCT, etc.) </ins>  <ins> a signer (either the private key associated with the certificate, or interface to perform private key operation) for each chain </ins>  <ins> an optional authenticator request </ins>  <ins> It returns the exported authenticator as output.  It is RECOMMENDED that the logic for selecting the certificates and extensions to include in the exporter is implemented in the TLS library. Implementing this in the TLS library lets the implementer take advantage of existing extension and certificate selection logic. It is also possible to implement this API outside of the TLS library using TLS exporters.  This may be preferable in cases where the application does not have access to a TLS library with these APIs or when TLS is handled independently of the application layer protocol. "validate", which takes as input: * an optional authenticator request * an authenticator It returns the certificate chain and extensions. </ins> 6. <ins> This document has no IANA actions. 7. </ins> The Certificate/Verify/Finished pattern intentionally looks like the TLS 1.3 pattern which now has been analyzed several times.  In the case where the client presents an authenticator to a server, SIGMAC


In summary, unsolicited flags may appear only in ClientHello, CertificateRequest, and NewSessionTicket.  4. IANA is requested to assign a new value from the TLS ExtensionType

This is to address a comment by Michael StJohns on the mailing list. To quote:

In summary, unsolicited flags may appear only in ClientHello, CertificateRequest, and NewSessionTicket. <ins> An implementation that receives an invalid tls_flags extension MUST terminate the TLS handshake with a fatal illegal_parameter alert. </ins> 4. IANA is requested to assign a new value from the TLS ExtensionType


Reference, which is a link to the document defining this flag. The policy for this shall be "Specification Required" as described in <del> RFC8126. </del>  The initial contents of the registry shall be one entry, as follows: The reference shall the the RFC-to-be I-D.ietf-tls-cross-sni- resumption. <del> 4.1. This extension allows up to 2040 flags.  However, they are not all the same, because the length of the extension is determined by the highest set bit. We would like to allocate the flags in such a way that the typical extension is as short as possible.  The scenario we want to guard against is that in a few years some extension is defined that all implementations need to support and that is assigned a high number because all of the lower numbers have already been allocated.  An example of such an extension is the Renegotiation Indication Extension defined in RFC5746. For this reason, the IANA experts should allocate the flags as follows: Flags 0-7 are reserved for documents coming out of the TLS working group with a specific request to assign a low number. Flags 8-31 are for standards-track documents that the experts believe will see wide adoption among either all users of TLS or a significant group of TLS users.  For example, an extension that will be used by all web clients or all smart objects.  The only entry in the initial registry is from this range. Flags 32-63 are for other documents, including experimental, that are likely to see significant adoption. Flags 64-79 are not to be allocated.  They are for reserved for private use. Flags 80-2039 can be used for temporary allocation in experiments, for flags that are likely to see use only in very specific environments, for national and corporate extensions, and as overflow, in case one of the previous categories has been exhausted. </del> 5. The extension described in this document provides a more concise way

No other advice is needed.
My interpretation of these is that these reduce to something like: 0-31 - standards action 32-63 - ??? (something like RFC Required or maybe Specification Required) 64-79 - might as well burn these for all the good they will do 80+ - open season (FCFS?) I can see the rationale for standards action here, but the rest of this should just be expert review (or specification required) along with guidance to experts. As this requires judgment, and the proponents of a new flag will lack the necessary perspective to have good judgment, a lot does depend on the nature of the guidance to experts. The document will need to provide experts with support that they can rely on: right now, the text does not do that. It relies too heavily on good judgment. If there is concrete advice that can be given about how to pick a value, then the document should do that. If it can't, as I suspect is the case, then it should either give experts the power to pick or just let authors grab for short values.
All TLS registries are "expert review" with no FCFS. I don't think we want this one to be the outlier. So how about making the segmentation in section 4, something like Then I can reduce the content of section 4.1 and just advise the expert to assign the first 7 bits only with a specific request from the WG. I don't want to specify the TLS working group, because something like this could potentially (though not likely) come from UTA or some such.
I don't think that sequential assignment has worked well for us. I would remove that part and maybe change the assignment rule to be "at the discretion of the expert" across the board, with a reminder that small values are more valuable and so should be reserved for things that are going to be used more often.
Fixed by .

Reference, which is a link to the document defining this flag. The policy for this shall be "Specification Required" as described in  <ins> RFC8126 with the exception of flags numbered from 0-15, which follow the "Standards Action" policy (RFC8126).  Designated expert(s) are advised to follow the advice in RFC8447 when reviewing registration requests. </ins> The initial contents of the registry shall be one entry, as follows: The reference shall the the RFC-to-be I-D.ietf-tls-cross-sni- resumption.  5. The extension described in this document provides a more concise way


An implementation that receives an invalid tls_flags extension MUST terminate the TLS handshake with a fatal illegal_parameter alert.  4. IANA is requested to assign a new value from the TLS ExtensionType

To solve issue
RFC8446 4.2.10 requires that: This extension does not (as far as I can see) do that. I think the text in tls-flags should prevaricate on this topic, because really it's an encoding framework for trivial extensions (that themselves need to define their interaction with 0-RTT.)
Created a PR. Let me know if this is satisfactory. URL
NAME NAME assume this one can be closed based on being merged?

An implementation that receives an invalid tls_flags extension MUST terminate the TLS handshake with a fatal illegal_parameter alert. <ins> 3.1. The 0-RTT handshake, defined in section 2.3 of RFC8446, has a ClientHello message, a ServerHello message, and an EncryptedExtensions message.  Those can include the tls_flags extension just as they can in a regular handshake. Future flag extensions MUST define their interaction with 0-RTT, just as other extensions are required to. </ins> 4. IANA is requested to assign a new value from the TLS ExtensionType


This document defines the following extension code point: This document also defines the data for this extension as a variable- <del> length bit string, allowing for the encoding of an unbounded number of features. </del>  The FlagExtensions field 8 flags with each octet, and its length is the minimal length that allows it to encode all of the present flags. IANA is also requested to create a new registry under the TLS namespace with name "TLS Flags" and the following fields: <del> Value, which is a number between 0 and 63.  All potential values </del>  are available for assignment. Flag Name, which is a string

See Issue draft-01 had three different versions of how many flags are possible to encode with this extension. This PR makes them all the same: up to 2048 flags.
The drafts says that values from 0 to 63 (inclusive) can be registered. But the syntax says , which implies 0 to 247. Which is it?
Reading it over, it seems worse than that. The draft contains three versions: Section 2 says "...allowing for the encoding of an unbounded number of features." The structure in section 2 has which implies 256 possible flags The IANA text has up to 64 flags Regardless, I think that the type for the flags field should be opaque: bistrings are not integers. And it's not going to be literally unbounded. Eight times the maximum length can be huge, but not quite unbounded. I think 64 will likely be enough, but I see no reason to artificially limit this. We can do and support up to 2048 flags without "wasting" even 1 byte. Of course, we can increase the length field to two bytes and allow up to 524,288 flags, but that seems over the top. So I'll make a pull request to align all three mentions to 255 bytes / 2048 flags.
Thanks, that seems like a fine idea. I agree that a two-byte length would make the overheads for the first few uses of this worse. And 2040 is an insanely large number of flags. Right now, signaling two flags this way costs 6 bytes as opposed to 8 with empty extensions. What seems more likely here is that we might need to split this into multiple extensions because the cost of flag 670 is too high if you aren't using smaller-valued flags. Note that this is 2040 (you can't include 256 bytes, the limit is 255).
I agree that anything beyond 128-bits seems to require many more bytes than the actual extension encoding. I'd prefer if this is capped to 64 or 128-bits.
I agree that anything beyond 128 is weird and would be an indication of mismanagement by TLS chairs and the IANA experts. Still, the format supports 2040 flags, and any other limit is arbitrary and can lead to buggy implementations enforcing or not enforcing such a limit. I prefer to leave it to chairs and IANA experts to be responsible gatekeepers, rather than tying their hands with artificial limits in rhe draft.
Future chairs and IANA experts would not have the insights you have at this point, so what you call mismanagement, it may not seem so in the future. I think some guidance in the IANA section indicating what you wrote above (that this extension is efficient and has most value when the extensions defined are using less than 128-bits), would give the proper guidance to them, to decide whether they continue using the extension or define another one. Otherwise if no guidance is provided and given that only "specification required" is necessary for a new flag to be defined, I find it likely that not all specifications using this flag will understand the repercussions of going more than 128-bits.
I agree. Did you see my message to the list? It went something like First octet is for standards-track documents coming out of TLS where the draft specifically requests such assignment. Like if we ever need a renegotiation_info again.Octets 2-4 are for other standards-track documents. Octets 5-7 are for experimental drafts. They don’t get re-assigned if they later become standards track Octets 8 are reserved-private Octets beyond that are in case we need more. And I think we can modify the last one to be just the low-quality flags, like vendor extensions or national extensions. Hopefully, implementations can work OK while ignoring those.
NAME NAME is this now resolved with having been merged?
NAME I think so. I will create the PR about IANA considerations guidance soonish.

This document defines the following extension code point: This document also defines the data for this extension as a variable-  <ins> length bit string, allowing for the encoding of up to 2040 features. </ins> The FlagExtensions field 8 flags with each octet, and its length is the minimal length that allows it to encode all of the present flags. IANA is also requested to create a new registry under the TLS namespace with name "TLS Flags" and the following fields:  <ins> Value, which is a number between 0 and 2039.  All potential values </ins> are available for assignment. Flag Name, which is a string


3.  A client that supports this extension and at least one flag extension SHALL send this extension with the flags field having bits set only for those extensions that it intends to set.  It MUST NOT send this extension with a length of zero. <del> A server that supports this extension and also supports at least one of the flag-type features that use this extension and that were declared by the ClientHello extension SHALL send this extension with the intersection of the flags it supports with the flags declared by the client.  The intersection operation may be implemented as a bitwise AND.  The server may need to send multiple tls_flags extensions, up to one in each of the four response messages that may carry extensions: ServerHello (SH), EncryptedExtensions (EE), Certificate (CT), and HelloRetryRequest (HRR).  It is up to the document for the specific feature to determine which of these should be used to acknowledge support. A server MUST NOT indicate support for any flag-type feature not previously indicated by the client in the ClientHello in any response message.  It MUST NOT include this extension in any of the four messages if it has no appropriate flag-type to indicate.  This extension MUST NOT be included empty. A server MAY indicate support for flag-type features in a flags extension of CertificateRequest (CR).  Flag-type extensions that have been indicated in CR (and only such extensions) MAY be also be present in a flags extension of the Certificate (CT) message sent by the client.  However, a client MUST NOT indicate support for any flag-type feature in a Certificate message that was not previously indicated by the server in its CertificateRequest message. A server MAY indicate support for flag-type features in a flags extension of NewSessionTicket (NST).  This message has no client-side response. In summary, unsolicited flags may appear only in ClientHello, CertificateRequest, and NewSessionTicket. </del> An implementation that receives an invalid tls_flags extension MUST terminate the TLS handshake with a fatal illegal_parameter alert.

Does it make sense to define a "echo this back" flag? Just thinking out loud. Argument against it is that clients will just always add that flag/extension ...
An empty extension remains as a cheaper option.
I'm not sure that you want to publish a document with a reference (even if informative) to the scas draft. Other than that, this is the right way to structure this, provided a couple of issues are resolved. I've suggestions for each.I proposed some simplifications and clarifications. Along with NAME proposed changes, I think this is good to go.

3. <ins> Any TLS implementation that intends to propose or indicate support for a flag extension SHALL send this extension with the relevant bits set.  It MUST NOT send this extension empty -- with a length of zero. This specification does not require every flag extension to be acknowledged.  Acknowledging a flag extension is typically needed to inform the peer proposing the extension that the other side understands and supports the extension, but some extensions do not require this acknowledgement. A flag proposed by the client in ClientHello (CH) that requires acknowledgement SHOULD be acknowledged in either ServerHello (SH), in EncryptedExtensions (EE), in Certificate (CT), or in HelloRetryRequest (HRR) as the corresponding flag document specifies. Similarly, a flag proposed by the server in the CertificateRequest (CR) message that requires acknowledgement SHOULD be acknowledged in the client's Certificate (CT) message.  A flag proposed by the server in the NewSessionTicket (NST) message is never acknowledged as there is not client-side response message. Multiple flags can be proposed or acknowledged in the same extension. In all of the above cases, a flag MUST NOT be acknowledged in SH, EE, CT, or HRR without first having been proposed in CH or CR. Unsolicited flags may appear only in CH, CR, and NST.  And endpoint that receives an unsolicited flag in another message (HRR, SH, EE, or CT) MUST generate a fatal illegal_parameter alert. </ins> A client that supports this extension and at least one flag extension SHALL send this extension with the flags field having bits set only for those extensions that it intends to set.  It MUST NOT send this extension with a length of zero.  An implementation that receives an invalid tls_flags extension MUST terminate the TLS handshake with a fatal illegal_parameter alert.


The policy for this shall be "Specification Required" as described in RFC8126.  4. The extension described in this document provides a more concise way

Provide guidance on what flag should be allocated to what extension, based on the likelihood of that extension being widely used.

The policy for this shall be "Specification Required" as described in RFC8126. <ins> 3.1. This extension allows up to 2040 flags.  However, they are not all the same, because the length of the extension is determined by the highest set bit. We would like to allocate the flags in such a way that the typical extension is as short as possible.  The scenario we want to guard against is that in a few years some extension is defined that all implementations need to support and that is assigned a high number because all of the lower numbers have already been allocated.  An example of such an extension is the Renegotiation Indication Extension defined in RFC5746. For this reason, the IANA experts should allocate the flags as follows: Flags 0-7 are reserved for documents coming out of the TLS working group with a specific request to assign a low number. Flags 8-31 are for standards-track documents that the experts believe will see wide adoption among either all users of TLS or a significant group of TLS users.  For example, an extension that will be used by all web clients or all smart objects. Flags 32-63 are for other documents, including experimental, that are likely to see significant adoption. Flags 64-79 are not to be allocated.  They are for reserved for private use. Flags 80-2039 can be used for temporary allocation in experiments, for flags that are likely to see use only in very specific environments, for national and corporate extensions, and as overflow, in case one of the previous categories has been exhausted. </ins> 4. The extension described in this document provides a more concise way


of the flag-type features that use this extension and that were declared by the ClientHello extension SHALL send this extension with the intersection of the flags it supports with the flags declared by <del> the client.  The intersection operation MAY be implemented as a bitwise AND.  The server may need to send two tls_flags extensions, one in the ServerHello and the other in the EncryptedExtensions message.  It is up to the document for the specific feature to determine whether support should be acknowledged in the ServerHello or the EncryptedExtensions message. </del>  A server MUST NOT indicate support for any flag-type feature not <del> previously indicated by the client.  It MUST NOT include this extension in either message (ServerHello or EncryptedExtensions) if it has no appropriate flag-type to indicate.  This extension MUST NOT be included empty. </del>  4. extensions.  It does not send in the clear any information that would otherwise be sent encrypted, nor vice versa.  For this reason this extension is neutral as far as security is concerned.

All messages that carry extensions can have a tls_flags extension: CH, SH, EE, Cert, NST
NAME can you please respond to the comments above?
Ping NAME :-)
Done.
I might have framed this slightly differently, but this accurately captures the outcome of the discussion. Thanks for doing this.

of the flag-type features that use this extension and that were declared by the ClientHello extension SHALL send this extension with the intersection of the flags it supports with the flags declared by  <ins> the client.  The intersection operation may be implemented as a bitwise AND.  The server may need to send multiple tls_flags extensions, up to one in each of the four response messages that may carry extensions: ServerHello (SH), EncryptedExtensions (EE), Certificate (CT), and HelloRetryRequest (HRR).  It is up to the document for the specific feature to determine which of these should be used to acknowledge support. </ins> A server MUST NOT indicate support for any flag-type feature not  <ins> previously indicated by the client in the ClientHello in any response message.  It MUST NOT include this extension in any of the four messages if it has no appropriate flag-type to indicate.  This extension MUST NOT be included empty. A server MAY indicate support for flag-type features in a flags extension of CertificateRequest (CR).  Flag-type extensions that have been indicated in CR (and only such extensions) MAY be also be present in a flags extension of the Certificate (CT) message sent by the client.  However, a client MUST NOT indicate support for any flag-type feature in a Certificate message that was not previously indicated by the server in its CertificateRequest message. A server MAY indicate support for flag-type features in a flags extension of NewSessionTicket (NST).  This message has no client-side response. In summary, unsolicited flags may appear only in ClientHello, CertificateRequest, and NewSessionTicket. </ins> 4. extensions.  It does not send in the clear any information that would otherwise be sent encrypted, nor vice versa.  For this reason this extension is neutral as far as security is concerned. <ins> Extension authors should be aware that acknowledging flags in a tls_flags extension of the ServerHello and HelloRetryRequest messages expose this response to passive observers.  Unless there is a special reason to place the response in the ServerHello, most flags should go in other (encrypted) messages. </ins>


The initial contents of the registry shall be one entry, as follows: <del> Value shall be 0x8 </del>  Flag Name shall be resumption_across_names Flags 8-31 are for standards-track documents that the experts believe will see wide adoption among either all users of TLS or a significant group of TLS users.  For example, an extension that <del> will be used by all web clients or all smart objects. </del>  Flags 32-63 are for other documents, including experimental, that are likely to see significant adoption.

Show the initial registry value is a decimal number rather than a hex number.
LGTM.

The initial contents of the registry shall be one entry, as follows:  <ins> Value shall be 8 </ins> Flag Name shall be resumption_across_names Flags 8-31 are for standards-track documents that the experts believe will see wide adoption among either all users of TLS or a significant group of TLS users.  For example, an extension that  <ins> will be used by all web clients or all smart objects.  The only entry in the initial registry is from this range. </ins> Flags 32-63 are for other documents, including experimental, that are likely to see significant adoption.