Subject: Re: [keyassure] PKIX/KIDNS validation results and

From: "Jeffrey A. Williams" <[email-masked]>
Date: Wed, 3 Nov 2010 16:25:14 -0500 (GMT-05:00)

Martin and all,

-----Original Message-----
>From: Martin Rex <[email-masked]>
>Sent: Nov 3, 2010 3:57 PM
>To: Jakob Schlyter <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [keyassure] PKIX/KIDNS validation results and
>
>Jakob Schlyter wrote:
>> 
>> On 3 nov 2010, at 17.44, Tony Finch wrote:
>> 
>> > If they are stored at _smtp._tcp.kirei.se then you can use a CNAME to deal
>> > with outsourced service, and support concurrent lookups of target hostname
>> > and cert material.
>> 
>> I most likely do not have the same key material for all SMTP servers.
>
>Which particular situation do you have in mind.
>
>Mutual MX-based backups with other servers is would be a different
>issue with independent hostnames.
>
>If your main SMTP hub uses several servers, sharing of private key
>and certificate usually should be possible, unless there is a pkcs#12 problem
>in the software, or the private key is (marked) non-exporable,
>ultimately because the private key is in hardware.
>
>Precluding multiple servers (redundancy) which cannot share keys
>would not be a good idea for KIDNS.  For key-rollover, you need
>to double that number again...

  I agree with this mainly because of cost, and the significant chance
of key-rollover problems that would be significantly damaging.
>
>
>-Martin
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
Network Eng. SR. Eng. Network data security
ABA member in good standing member ID 01257402 
E-Mail [email-masked]
Phone: 214-244-4827