Someone wrote in [personal profile] mjg59 2022-05-16 04:40 pm (UTC)

tokbind, mtls, tls 1.3's new dance

The IETF TOKBIND working group (https://datatracker.ietf.org/wg/tokbind/about) attempted to solve the problem of stolen bearer tokens by associating them with the TLS connection itself, so they couldn't be moved to another system. Eventually Google refused TOKBIND. If something won't be added to Chrome it won't matter. The rumored justification was TOKBIND would change/break web development.

Doing mutual TLS, as you suggest, breaks enterprise-deployed in-line TLS proxies (Bluecoat, et al). To avoid that breakage, while still providing mutual TLS, the new hotness seems a normal TLS 1.3 handshake (which appeases TLS proxies) and then upgrading to mutual TLS within that TLS connection (https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.2).

Post a comment in response:

If you don't have an account you can create one now.
HTML doesn't work in the subject.
More info about formatting

If you are unable to use this captcha for any reason, please contact us by email at support@dreamwidth.org