Subject: [Acme] Removing OOB Challenge Type

From: Daniel McCarney <[email-masked]>
Date: Thu, 30 Nov 2017 11:03:06 -0500

Hi folks,

In a previous thread[0] surveying ACME implementations two commercial CAs
(BuyPass and DigiCert) outlined that their ACME integrations use external
account binding but **not** the Out-of-Band (OOB) challenge type.

As Clint from DigiCert points out[1] having a binding with an external
account enables access to the full context of any non-ACME
authorizations/challenges the CA requires through existing systems.

Overall, the OOB challenge type:
* has no server implementations
* has no client implementations
* has no dependent use-cases presented to the WG
* offers a subset of what external account binding already offers

Removing it from the draft seems like a sensible decision to me. If there
is demand (& accompanying client/server implementations) the challenge type
could easily be re-added in a follow-up work.

- Daniel / cpu

[0] https://mailarchive.ietf.org/arch/msg/acme/oFPXvSnocJZorYiR8Tj6cYbA_wY
[1] https://mailarchive.ietf.org/arch/msg/acme/COZ3xDpBTTvgmbbEc8fLDnu0Onw
[2] https://github.com/ietf-wg-acme/acme/pull/360

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 30 Nov 2017 16:42:11 +0000

Does anyone disagree with Daniel’s reasoning?  If so, please speak up before next Friday.

Daniel, please do not merge this until we determine WG consensus.

---

From: Daniel McCarney <[email-masked]>
Date: Thu, 30 Nov 2017 12:24:57 -0500

> Daniel, please do not merge this until we determine WG consensus

Of course :-) I don't have any merge privileges!

---

From: Clint Wilson <[email-masked]>
Date: Thu, 30 Nov 2017 17:39:32 +0000

I agree with the reasoning and decision to remove this.
While I think it's possible for this challenge type to become useful in the
future, I don't have any justification for keeping it in in the meantime.
As Daniel notes, it's straightforward to add it back if needed.

On Thu, Nov 30, 2017, 10:25 AM Daniel McCarney <[email-masked]> wrote:

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Thu, 30 Nov 2017 10:22:56 -0800

I agree with this change. It's a good plan to not try and pre-specify
things like OOB that aren't on anyone's roadmap, because that leaves the
space open for a better specification once someone wants to implement it.

On 11/30/2017 09:39 AM, Clint Wilson wrote:
> While I think it's possible for this challenge type to become useful
> in the future, I don't have any justification for keeping it in in the
> meantime. As Daniel notes, it's straightforward to add it back if needed.
>
>
> On Thu, Nov 30, 2017, 10:25 AM Daniel McCarney <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     On Thu, Nov 30, 2017 at 11:42 AM, Salz, Rich <[email-masked]
>     <mailto:[email-masked]>> wrote:
>
>     [email-masked] <mailto:[email-masked]>

---

From: Andrew Ayer <[email-masked]>
Date: Thu, 30 Nov 2017 15:07:59 -0800

No objections here.

Regards,
Andrew

On Thu, 30 Nov 2017 10:22:56 -0800
Jacob Hoffman-Andrews <[email-masked]> wrote:

> things like OOB that aren't on anyone's roadmap, because that leaves
> the space open for a better specification once someone wants to
> implement it.
> 
> > in the future, I don't have any justification for keeping it in in
> > the meantime. As Daniel notes, it's straightforward to add it back
> > if needed.
> >
> >