4.1.5 Verifying a certificate using trust on first use authentication

It is possible to use a trust on first use (similar to SSH) authentication method in GnuTLS. That is the concept used by the SSH programs, where the public key of the peer is not verified, or verified in an out-of-bound way, but subsequent connections to the same peer require the public key to remain the same. Such a system in combination with the typical CA verification of a certificate, and OCSP revocation checks, can help to provide multiple factor verification, where a single point of failure is not enough to compromise the system. For example a server compromise may be detected using OCSP, and a CA compromise can be detected using the trust on first use method. Such a hybrid system with X.509 and trust on first use authentication is shown in Simple client example with SSH-style certificate verification.

• gnutls_verify_stored_pubkey

• gnutls_store_pubkey

In addition to the above the gnutls_store_commitment can be used to implement a key-pinning architecture as in [KEYPIN]. This provides a way for web server to commit on a public key that is not yet active.

• gnutls_store_commitment

The storage and verification functions may be used with the default text file based back-end, or another back-end may be specified. That should contain storage and retrieval functions and specified as below.

• gnutls_tdb_init
• gnutls_tdb_deinit
• gnutls_tdb_set_verify_func
• gnutls_tdb_set_store_func
• gnutls_tdb_set_store_commitment_func

This document was generated on March 2, 2012 using texi2html 5.0.