Subject: Re: Last Call: 'Storing Certificates in the Domain Name System (DNS)' to Proposed Standard

From: Pekka Savola <[email-masked]>
Date: Fri, 23 Sep 2005 20:17:42 +0300 (EEST)

On Fri, 23 Sep 2005, Ólafur Guðmundsson wrote:
>       0            reserved
>       1   PKIX     X.509 as per PKIX
>        2   SPKI     SPKI certificate
>       3   PGP       OpenPGP packet
>       4   IPKIX     The URL of an X.509 data object
>       5   ISPKI     The URL of an SPKI certificate
>       6   IPGP      The URL of an OpenPGP packet
>       7-252        available for IANA assignment by IETF Standards action
>       253   URI    URI private
>       254   OID    OID private
>       255-65023    available for IANA assignment by IETF Consensus.
>        65024-65534  experimental
>       65535        reserved

Please also add references here to the documents which define those 
CERT types.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 24 Sep 2005 00:24:11 +0200

> Please also add references here to the documents which define those 

What do you mean?  The types are defined by the same document, RFC
2538bis.

Regards,
Simon

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Pekka Savola <[email-masked]>
Date: Sat, 24 Sep 2005 13:19:53 +0300 (EEST)

> What do you mean?  The types are defined by the same document, RFC

Sorry, for clarity, I should have written, "define those CERT types or 
the protocols using them".  This is useful in particular if a protocol 
emerged after RFC2538 which was assigned such a cert type.

You could turn this another way around, and ask "if a user sess this 
CERT type, where could it find more information on the protocol using 
the CERT type?"

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 24 Sep 2005 12:53:22 +0200

> CERT type, where could it find more information on the protocol using 

I see.  I have changed the IANA considerations to read as below.  If
this is a problem for anyone, please speak up.  For the entire updated
document, see <http://josefsson.org/rfc2538bis/>.

If someone wants to find out more about the particular format used for
a particular CERT type, they have to chase the references in the RFC
in the IANA table.  The RFC numbers added to the IANA registry should
be to the RFC that define the new CERT type.

Thanks,
Simon

   IANA needs to create a new registry for CERT RR, certificate types.
   The initial contents of this registry is:

   [[RFC Editor: Replace xxxx below with the number of this RFC.]]

   Decimal   Type     Meaning                              Reference
   -------   ----     -------                              ---------
         0            Reserved                             RFC xxxx
         1   PKIX     X.509 as per PKIX                    RFC xxxx
         2   SPKI     SPKI certificate                     RFC xxxx
         3   PGP      OpenPGP packet                       RFC xxxx
         4   IPKIX    The URL of an X.509 data object      RFC xxxx
         5   ISPKI    The URL of an SPKI certificate       RFC xxxx
         6   IPGP     The URL of an OpenPGP packet         RFC xxxx
     7-252            Available for IANA assignment
                         by IETF Standards action
       253   URI      URI private                          RFC xxxx
       254   OID      OID private                          RFC xxxx
   255-65023          Available for IANA assignment
                         by IETF Consensus
   65024-65534        Experimental                         RFC xxxx
     65535            Reserved                             RFC xxxx

   Certificate types 0x0000 through 0x00FF and 0xFF00 through 0xFFFF can
   only be assigned by an IETF standards action [7].  This document
   assigns 0x0001 through 0x0006 and 0x00FD and 0x00FE.  Certificate
   types 0x0100 through 0xFEFF are assigned through IETF Consensus [7]
   based on RFC documentation of the certificate type.  The availability
   of private types under 0x00FD and 0x00FE ought to satisfy most
   requirements for proprietary or private types.

   The CERT RR reuses the DNS Security Algorithm Numbers registry.  In
   particular, the CERT RR requires that algorithm number 0 remain
   reserved, as described in Section 2.  The IANA is directed to
   reference the CERT RR as a user of this registry and value 0, in
   particular.