Subject: Re: [keyassure] Validation Preferences / Subordinate

From: "Jeffrey A. Williams" <[email-masked]>
Date: Tue, 21 Sep 2010 16:27:59 -0500 (GMT-05:00)

Phillip and all,

-----Original Message-----
From: Phillip Hallam-Baker
Sent: Sep 21, 2010 4:13 PM
To: Jakob Schlyter
Cc: [email-masked], Carl Wallace
Subject: Re: [keyassure] Validation Preferences / Subordinate

On Tue, Sep 21, 2010 at 3:09 PM, Jakob Schlyter <[email-masked]> wrote:

On 21 sep 2010, at 17.22, Carl Wallace wrote:

> The flag is of limited utility when a non-self-signed certificate is in
> use.  A permissive client will accept the cert outright if the key
> association matches.  A non-permissive client will perform the entire
> bit of extra work.  The only case where the flag seems useful is where
> the server cert is issued off of some internal CA.

The flag will be very useful in case you want to do DNSSEC-assisted key assurance in combination with a traditional PKIX certification, like EV. In that use case, the key assurance will provide important exclusion (no other certs are acceptable for the host) whereas the PKIX certification will provide stronger authentication of the key holder.

I really do not accept that an assurance delivered via CERT should be exclusive.

Very much agreed!

The text in section 3 of the Hofman et. al. draft does not make these semantics explicit. I think that such semantics in a CERT record would be a terrible idea.

Yes I also agree that section 3 as you indicated leaves too much to varried judgments after tha fact, so more

explicit language is needed.

If we are going to define semantics of that type we need to consider other mechanisms for defining the allowable trust roots for a domain.

We can get the assignments for the CERT record certificate types to do key assurance without even creating a working group. Attempting to use the CERT record to implicitly establish a root of trust for a domain is a very different issue.

I still have trouble what is a 'Root of Trust' and whom/how such a desigination is confidently determined.

--
Website: http://hallambaker.com/

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827