Subject: Re: Last Call: 'Storing Certificates in the Domain Name System (DNS)' to Proposed Standard

From: Ólafur Guðmundsson<[email-masked]>
Date: Fri, 23 Sep 2005 10:29:40 -0400

At 03:53 20/09/2005, Olaf M. Kolkman wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>Dear Colleagues,
>
>I have the impression we are going around in circles and that we are
>not converging any further.
>
>I'd like to ask if we can all consent with the document as is now
>(http://josefsson.org/rfc2538bis/draft-ietf-dnsext-rfc2538bis-06.txt).

<chair-hat=off>
I hate to do this at this late time, but IANA section is not sufficient.
IANA dropped the ball on RFC2538 and never created the requested
CERT RR registry and the WG never noticed this.
So the new document needs to say explicitly that the registry
needs to be created and define the initial contents.

Suggested IANA considerations section:
--------
IANA needs to create a new registry for CERT RR, certificate types.
The initial contents of this registry is:
        0            reserved
        1   PKIX     X.509 as per PKIX
         2   SPKI     SPKI certificate
        3   PGP       OpenPGP packet
        4   IPKIX     The URL of an X.509 data object
        5   ISPKI     The URL of an SPKI certificate
        6   IPGP      The URL of an OpenPGP packet
        7-252        available for IANA assignment by IETF Standards action
        253   URI    URI private
        254   OID    OID private
        255-65023    available for IANA assignment by IETF Consensus.
         65024-65534  experimental
        65535        reserved

Certificate types 0x0000 through 0x00FF and 0xFF00 through 0xFFFF can
only be assigned by an IETF standards action [7].  This document
assigns 0x0001 through 0x0006 and 0x00FD and 0x00FE.  Certificate
types 0x0100 through 0xFEFF are assigned through IETF Consensus [7]
based on RFC documentation of the certificate type.  The availability
of private types under 0x00FD and 0x00FE ought to satisfy most
requirements for proprietary or private types.

The CERT RR reuses the DNS Security Algorithm Numbers registry.  In
particular, the CERT RR requires that algorithm number 0 remain
reserved, as described in Section 2.  The IANA is directed to
reference the CERT RR as a user of this registry and value 0, in
particular.
------
>- --Olaf (In capacity of "document shepherd" )

I do not think this is controversial, and in off-list discussion Simon
and Olaf seem to agree with this change.

The main change is that range 65024-65534 is defined as experimental
and no allocations will be made in that area.

         Olafur (as the nit-picker-in-residence)  

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>