Horton

Re: RFC 9266: Channel Bindings for TLS 1.3 support

Nico Williams <nico@cryptonector.com>

View thread
From: Nico Williams <nico@cryptonector.com>
To: * Neustradamus * <neustradamus@hotmail.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>, "simon@josefsson.org" <simon@josefsson.org>, "alexey.melnikov@isode.com" <alexey.melnikov@isode.com>
Date: 2025-11-21T17:30:00Z
Lists: pgsql-hackers 
On Fri, Nov 21, 2025 at 08:30:42AM +0000, * Neustradamus * wrote:
> Dear Heikki,
> 
> Thanks for your answer.
> 
> Several people would like to deprecate "tls-server-end-point" (RFC 5929) like Simon Josefsson (author of several RFCs) because RFC 9266 exists since July 2022:

We must either fix or _replace_ tls-server-end-point (TSEP), but we
cannot not have end-point-style CB.  I followed up to Simon with reasons
for why.  Those followups will also answer Heikki's questions about
pros/cons.

That said, for _PG_ I think the exporter CB are almost certainly better.

Nico
--