<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does it mean that when switch to HTTP/2, the concern is not valid any longer? Or there is an alternative solution? Sorry for the questions, I know little about servlet. I'm trying to understand the requirement of this feature.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Xuelei</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> arjan tijms <arjan.tijms@gmail.com><br>
<b>Sent:</b> Thursday, March 4, 2021 2:08 PM<br>
<b>To:</b> Xue-Lei Fan <xuelei.fan@oracle.com><br>
<b>Cc:</b> security-dev@openjdk.java.net <security-dev@openjdk.java.net><br>
<b>Subject:</b> [External] : Re: TLS 1.3 Post-handshake authentication</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">Hi,</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Thu, Mar 4, 2021 at 10:48 PM Xue-Lei Fan <<a href="mailto:xuelei.fan@oracle.com">xuelei.fan@oracle.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-style:solid; border-left-color:rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<BCC jdk-dev, forward to security-dev></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hi Arjan,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Did you have a chance to read RFC 8740? Post-Handshake authentication in HTTP/2 is not allowed for TLS 1.3. Is there a concern for the use case you mentioned?</div>
</div>
</blockquote>
<div><br>
</div>
<div>Servlet supports both HTTP/1.1 and HTTP/2. The concern here is for HTTP/1.1. We'll likely exclude client-cert for HTTP/2.</div>
<div><br>
</div>
<div>Kind regards,</div>
<div>Arjan Tijms</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div> </div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-style:solid; border-left-color:rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Xuelei</div>
<div id="x_gmail-m_-6966356882376074691appendonsend"></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_-6966356882376074691divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> jdk-dev <<a href="mailto:jdk-dev-retn@openjdk.java.net" target="_blank">jdk-dev-retn@openjdk.java.net</a>> on
behalf of arjan tijms <<a href="mailto:arjan.tijms@gmail.com" target="_blank">arjan.tijms@gmail.com</a>><br>
<b>Sent:</b> Thursday, March 4, 2021 12:57 PM<br>
<b>To:</b> <a href="mailto:jdk-dev@openjdk.java.net" target="_blank">jdk-dev@openjdk.java.net</a> <<a href="mailto:jdk-dev@openjdk.java.net" target="_blank">jdk-dev@openjdk.java.net</a>><br>
<b>Subject:</b> TLS 1.3 Post-handshake authentication</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div>Hi,<br>
<br>
I noticed the following issue was recently closed:<br>
<br>
<a href="https://bugs.openjdk.java.net/browse/JDK-8206923" target="_blank">https://bugs.openjdk.java.net/browse/JDK-8206923</a><br>
<br>
For the Servlet spec this is however a very important feature, to the point<br>
that for the Servlet TCK we would need to explicitly allow vendors to use<br>
TLS 1.2 for the client-cert authentication mechanism test.<br>
<br>
Servlet needs this post-handshake authentication, since it allows the<br>
server to have protected/secured resources on a URL basis. During the<br>
handshake the URL that the client wishes to request is not yet available,<br>
so the server is unable to determine at that point whether it requires the<br>
client to present a certificate.<br>
<br>
Only when the request is being serviced can the server determine this, and<br>
respond with a certificate request. This however fails when using TLS 1.3,<br>
since it's not implemented in Java.<br>
<br>
The issue mentions that it might be implemented on request, so hereby I<br>
would like to request this.<br>
<br>
Kind regards,<br>
Arjan Tijms (Servlet spec committer)<br>
</div>
</span></font></div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>