340044 - Implement TLS server side of "fixed_ECDH" client auth methods

Status: NEW

(NSS :: Libraries, defect, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

RFC 4492 (ECC in TLS) defines 3 methods for client authentication.
NSS presently implements only the first one: ECDSA_sign 
which is most like the client auth method used with RSA certs.

This RFE asks for NSS to implement the other two, 
          ECDSA_fixed_ECDH      
          RSA_fixed_ECDH    
on the server side, so that an NSS server can ask a remote TLS client 
to authenticate with these methods instead of, or in addition to, the
ECDSA_sign.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Note that presently, NSS servers configured to request client auth for ECC
will always request the method ECDSA_sign, and all the desktop ECC TLS 
clients are believed to implement this method.