Re: ktls-utils and gnutls

[Daiki Ueno <ueno@gnu.org>]

Hannes Reinecke <hare@suse.de> writes:

> There are some issues which could've been addressed:
>
> 1. Multiple PSK keys per ClientHello: the RFC allows for multiple
>    PSKs to be sent with each ClientHello, yet gnutls implements
>    only support for a single PSK. This is getting interesting
>    when several cipher suites with different lengths or different
>    scopes are supported, and the server could pick the appropriate
>    one instead of having the client to retry a ClientHello with
>    every available PSK.
>
> 2. Support for SPDM device attestation certificates: SPDM has defined
>    the use of X.509 certificates for device attestation. But as these
>    certificates are not bound to a network instance SPDM makes use
>    of 'Subject Alternative Name' with a distinct OID. It would be
>    good to implement support for SPDM X.509 certificates as chances
>    are they will become more prevalent.
>    And any implementor will need to generate valid SPDM certificates
>    to test out the implementation ...

Thank you.  I've added both ideas to the list.

Regards,
-- 
Daiki Ueno