diff --git a/clnt-vc-srvr-x509.svg b/clnt-vc-srvr-x509.svg new file mode 100644 index 0000000..4787026 --- /dev/null +++ b/clnt-vc-srvr-x509.svg @@ -0,0 +1,31 @@ +ClientClientServerServerDLT_BDLT_BClient Hello+ client_cert_types*=(X.509, VC)+ server_cert_types*=(X.509, RawPublicKey)+ key_share*+ sig_algs*Server Hello+ key_share*{ Encrypted Extensions+ client_cert_types*=VC+ server_cert_types*=X.509 }{ Certificate request*+ did_methods*=(iota,btcr)}{ Certificate* }{ Certificate Verify* }{ Finished }{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve \ No newline at end of file diff --git a/clnt-x509-srvr-vc.svg b/clnt-x509-srvr-vc.svg new file mode 100644 index 0000000..7612a15 --- /dev/null +++ b/clnt-x509-srvr-vc.svg @@ -0,0 +1,31 @@ +DLT_ADLT_AClientClientServerServerClient Hello+ client_cert_types*=(X.509, RawPublicKey)+ server_cert_types*=(VC, X.509)+ key_share*+ sig_algs*+ did_methods*=(iota)Server Hello+ key_share*{ Encrypted Extensions+ client_cert_types*=X.509+ server_cert_types*=VC }{ Certificate request* }{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve{ Certificate* }{ Certificate Verify* }{ Finished } \ No newline at end of file diff --git a/draft-vesco-vcauthtls.md b/draft-vesco-vcauthtls.md index efc75b5..fa440d6 100644 --- a/draft-vesco-vcauthtls.md +++ b/draft-vesco-vcauthtls.md @@ -143,7 +143,9 @@ struct { {{tls-full}} below shows the basic full TLS handshake: -~~~plantuml + + +![](full-hs.svg) + {: #tls-full title="Message Flow for Full TLS Handshake"} ## Client Hello @@ -205,8 +212,9 @@ Figures [x], [x] and [x] show some message-exchanges examples. This section shows an example that the client is willing to receive and validate a VC from the server. The client does not own an identity at the TLS level and so omits the client_cert_type extension. The server indicates in the EncryptedExtensions message that it selected a VC to insert in the Certificate message as depicted in Figure [X]. -~~~plantuml -@startuml + + +![](srvr-vc.svg) ## TLS Client and Server Use VCs This section shows an example where the TLS client as well as the TLS server use VCs as presented in figure [X]. In fact the server selects VC type for both client_cert_types and server_cert_types extensions and in the CertificateRequest message selects a set of DID methods both endpoints have in common. -~~~plantuml -@startuml + + +![](mutual-vc.svg) ## TLS Client Uses a VC and Server Uses an X.509 Certificate This section shows an example combining the use of a raw public key and an X.509 certificate. The client uses a VC for client authentication, and the server provides an X.509 certificate. The client expresses its ability to process an X.509 certificate or a raw public key from the server. In addtion it is willing to use either VC or X.509 certificate for client-side authentication. The server then selects X.509 certificate to authenticate with the client and VC for client authentication. The server sends a list of its choice of DID methods. -~~~plantuml -@startuml + + +![](clnt-vc-srvr-x509.svg) ## TLS Client Uses Certificate and Server Uses VC This section shows an example of a client authenticating with an X.509 certificate and a server with a VC. The client is capable to process and validate a VC from the server, in fact it also sends the did_methods extension. The server then decides to request an X.509 certificate from the client and provide a VC to authenticate with the client. -~~~plantuml -@startuml + + +![](clnt-x509-srvr-vc.svg) ## Renegotiation of DID Methods diff --git a/full-hs.svg b/full-hs.svg new file mode 100644 index 0000000..c667531 --- /dev/null +++ b/full-hs.svg @@ -0,0 +1,33 @@ +DLT_ADLT_AClientClientServerServerDLT_BDLT_BClient Hello+ client_cert_types*+ server_cert_types*+ key_share*+ sig_algs*+ did_methodsServer Hello+ key_share*{ Encrypted Extensions+ client_cert_types*+ server_cert_types* }{ Certificate request*+ did_methods* }{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve \ No newline at end of file diff --git a/mutual-vc.svg b/mutual-vc.svg new file mode 100644 index 0000000..4f5260a --- /dev/null +++ b/mutual-vc.svg @@ -0,0 +1,33 @@ +DLT_ADLT_AClientClientServerServerDLT_BDLT_BClient Hello+ client_cert_types*=(VC,X.509,RawPublicKey)+ server_cert_types*=(X.509,VC,RawPublicKey)+ did_methods=(iota,btcr)+ key_share*+ sig_algs*Server Hello+ key_share*{ Encrypted Extensions+ client_cert_types*=VC+ server_cert_types*=VC }{ Certificate request*+ did_methods*=(iota) }{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve \ No newline at end of file diff --git a/srvr-vc.svg b/srvr-vc.svg new file mode 100644 index 0000000..6c279d4 --- /dev/null +++ b/srvr-vc.svg @@ -0,0 +1,29 @@ +IOTAIOTAClientClientServerServerClient Hello+ server_cert_types*=(VC,X.509)+ did_methods*=(iota,btcr)+ key_share*+ sig_algs*Server Hello+ key_share*{ Encrypted Extensions+ server_cert_types*=VC }{ Certificate* }{ Certificate Verify* }{ Finished }DID Resolve{ Finished } \ No newline at end of file