Subject: Re: [keyassure] An interesting twist

From: "Jeffrey A. Williams" <[email-masked]>
Date: Tue, 14 Sep 2010 15:43:03 -0500 (GMT-05:00)

Phillip and all,

+1

-----Original Message-----
From: Phillip Hallam-Baker
Sent: Sep 14, 2010 3:38 PM
To: "Richard L. Barnes"
Cc: [email-masked]
Subject: Re: [keyassure] An interesting twist

I agree with Matt and Roger.

If we need assurances for complete certs in the DNS I prefer to define a new certificate type since that seems to be the simplest approach.

My original question was whether there is actually sufficient need for full certs to do this.

I would much prefer to know people's preferences before writing the draft because getting this type of text precise takes a lot of work.

On Tue, Sep 14, 2010 at 4:03 PM, Richard L. Barnes <[email-masked]> wrote:

On Sep 14, 2010, at 3:43 PM, Matt McCutchen wrote:

On Tue, 2010-09-14 at 19:35 +0200, Simon Josefsson wrote:

Phillip Hallam-Baker <[email-masked]> writes:

At the moment we have a PKIX cert type for the raw cert data but it does not
provide an assurance. Therefore if people want to express an assurance for
raw cert data we need to define a second cert type for PKIX cert data which
asserts an assurance.

What do you mean by 'assurance' here?  As far as I understand, any
assurance comes from DNSSEC so adding another CERT sub-type does nothing
to improve assurance.

The claim is that records of the existing CERT subtypes are purely
informational, and a new subtype is needed to indicate the specific
intent that clients should use the public key for TLS connections to the
host name in question without further verification.  DNSSEC protection
of the records is also necessary, but a separate issue.

To be more precise, *some* *signal* is necessary to indicate that a given CERT record should be used in conjunction with TLS.  It doesn't necessarily have to be a new subtype; it could be either a layer down (e.g., an SRV-style service label) or a layer up (e.g., an X.509 attribute).  I'm not advocating any of these approaches, just clarifying the bounds of the design space.

--Richard

_______________________________________________
keyassure mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyassure

--
Website: http://hallambaker.com/

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827