501a89d354
Daniel Stenberg
2026-09-22
Subject
TODO: TLS channel bindings exists
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
docs/TODO.md+0 -17
| @@ -449,23 +449,6 @@ the communicating parties. | |
| [curl issue 5081](https://github.com/curl/curl/issues/5081) | |
| - | ## TLS channel binding |
| - | |
| - | TLS 1.2 and 1.3 provide the ability to extract some secret data from the TLS |
| - | connection and use it in the client request (usually in some sort of |
| - | authentication) to ensure that the data sent is bound to the specific TLS |
| - | connection and cannot be successfully intercepted by a proxy. This |
| - | functionality can be used in a standard authentication mechanism such as |
| - | GSS-API or SCRAM, or in custom approaches like custom HTTP Authentication |
| - | headers. |
| - | |
| - | For TLS 1.2, the binding type is usually `tls-unique`, and for TLS 1.3 it is |
| - | `tls-exporter`. |
| - | |
| - | - https://datatracker.ietf.org/doc/html/rfc5929 |
| - | - https://datatracker.ietf.org/doc/html/rfc9266 |
| - | - [curl issue 9226](https://github.com/curl/curl/issues/9226) |
| - | |
| ## Defeat TLS fingerprinting | |
| By changing the order of TLS extensions provided in the TLS handshake, it is | |