<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<BCC jdk-dev, forward to security-dev></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Arjan,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Did you have a chance to read RFC 8740? Post-Handshake authentication in HTTP/2 is not allowed for TLS 1.3. Is there a concern for the use case you mentioned?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Xuelei</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> jdk-dev <jdk-dev-retn@openjdk.java.net> on behalf of arjan tijms <arjan.tijms@gmail.com><br>
<b>Sent:</b> Thursday, March 4, 2021 12:57 PM<br>
<b>To:</b> jdk-dev@openjdk.java.net <jdk-dev@openjdk.java.net><br>
<b>Subject:</b> TLS 1.3 Post-handshake authentication</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
I noticed the following issue was recently closed:<br>
<br>
<a href="https://bugs.openjdk.java.net/browse/JDK-8206923">https://bugs.openjdk.java.net/browse/JDK-8206923</a><br>
<br>
For the Servlet spec this is however a very important feature, to the point<br>
that for the Servlet TCK we would need to explicitly allow vendors to use<br>
TLS 1.2 for the client-cert authentication mechanism test.<br>
<br>
Servlet needs this post-handshake authentication, since it allows the<br>
server to have protected/secured resources on a URL basis. During the<br>
handshake the URL that the client wishes to request is not yet available,<br>
so the server is unable to determine at that point whether it requires the<br>
client to present a certificate.<br>
<br>
Only when the request is being serviced can the server determine this, and<br>
respond with a certificate request. This however fails when using TLS 1.3,<br>
since it's not implemented in Java.<br>
<br>
The issue mentions that it might be implemented on request, so hereby I<br>
would like to request this.<br>
<br>
Kind regards,<br>
Arjan Tijms (Servlet spec committer)<br>
</div>
</span></font></div>
</body>
</html>