Subject: Re: [keyassure] Possible working group, BOF

From: =JeffH <[email-masked]>
Date: Fri, 03 Sep 2010 17:52:47 -0700

fwiw, I support this effort morphing into a WG w/o a BoF.

[email-masked] said:
 >
 > It is incorrect to handle this stuff at the TLS layer.  Applications   define
 > what sort of name authentication they require; from that   perspective TLS is
 > simply a vehicle for one type of credential.  What   I would expect out of
 > this group is a document saying "This is how you   use a combination of <foo>
 > from the DNS with the certificate you get   in TLS to authenticate a remote
 > entity in <bar> application" -- more a   procedure for using the two
 > protocols than a modification to either.

+1

Note also that draft-saintandre-tls-server-id-check is updating RFC2818 wrt 
subject identity/identifier matching -- the above would presumably be employed 
in combination with the latter in some fashion.

=JeffH

---

From: Yaron Sheffer <[email-masked]>
Date: Sat, 04 Sep 2010 23:38:30 +0300

Adding my two cents, now that the traffic level is a bit lower.

- I suggest that the charter specify which protocols are in scope, to 
avoid the WG veering off later in strange and surprising directions. My 
personal candidate list is TLS (+DTLS), IPsec and SSH.

- The draft charter implies but does not state explicitly that *only* 
name::public-key binding is in scope. That is, the domain operator 
cannot and should not authenticate other information that may live 
inside a cert (e.g. the infamous cert image). So, if there is consensus 
around it, please state clearly that public keys are in scope, 
certificates are not.

I would support going immediately to WG if the charter had been more 
specific. Without a list of deliverables, it feels like this effort is 
not yet ready for a WG, and would benefit from having a BOF to build 
consensus exactly on these points: which protocols are covered, and what 
documents are needed.

Thanks,
	Yaron