Subject: Defining an SRV RR Other name in pkix

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 13 Jun 2005 10:10:40 +0100

Tim and Steve,

Based on the previous discussion on this issue I'm asking you as WG
chair to consider accepting the definition of an SAN Other Name for
Service Resource Records (SRV RR) as a PKIX work item based on the input
from my previously submitted draft and discussions on this list.

http://www.ietf.org/internet-drafts/draft-santesson-pkix-srvrr-00.txt

My summary: 
Arguments from Sam have suggested that we need to add clear guidance
that binding a certificate to a SRV RR must be done in accordance with
the appropriate security considerations for each defined symbolic name
for each service type. 

Several postings have also suggested that the SRV RR name should be
encoded in UTF-8 and not IA5String.

I agree with these observations and plan to accommodate them in the next
draft.

Considering the limited technical scope of this draft I foresee no other
hard technical issues to be solved and I think that finalization of this
work should be possible to be achieved within the timeframe of the Paris
meeting.

Speaking as vendor I strongly believe in the need for this name form to
support an increased use of SRV RR for DNS based service queries and I
would therefore prefer, for interoperability reasons, to implement this
name form based on an RFC rather than going ahead with a privately
defined name.

In any case (going forward as private or pkix draft), I would like to
have an IETF OID defined for this Other Name to be included in the next
draft.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

---

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 14 Jun 2005 13:01:12 +0100

Yes.

Stefan Santesson

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: den 14 juni 2005 04:14
> To: Russ Housley
> Cc: Stefan Santesson; [email-masked]; [email-masked]
> Subject: Re: Defining an SRV RR Other name in pkix
> 
> In message <[email-masked]>, Russ
> Housley w
> rites:
> >Stefan:
> >
> >The best approach is probable to request Steve Bellovin to ask the
DNS
> >Directorate for a review.  You can reach Steve Bellovin at the
address on
> >the CC line.
> >
> 
> Is there a draft?
> 
> 		--Steven M. Bellovin,
> http://www.cs.columbia.edu/~smb
>

---

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 16 Jun 2005 15:00:51 +0100

Sam,

It feels like we have a misunderstanding.
Comments below;

> From: Sam Hartman [mailto:[email-masked]]
> 
> So, the SRV record is currently about mapping a name supplied by the
> user into a name of a location.  We all agree that the name supplied
> by the user should be used for certificate authentication.
> 

[Stefan] Good. This is all I want to do.

> You propose to take a registry associated with SRV records--the
> application spe.specific label--and make that a security registry for
> distinguishing applications in certificates.
> 

[Stefan] I'm not sure what this means, but it does not sound to me what
I propose. I just want to take the name supplied by the user, i.e. the
query string _Service._Proto.Name and use it for certificate
authentication.

Just as you said.

> 
> That's extending the scope of the metadata associated with SRV.  That
> extension needs to be something the DNS community is happy with.

[Stefan] The full SRV RR is defined as:

_Service._Proto.Name TTL Class SRV Priority Weight Port Target

I just want to allow the query string (_Service._Proto.Name) to be
present in the certificate.

This is a way for the CA to tell the client that the host with this
certificate is authorized to provide a service that match that query
string.

How is that extending the scope the metadata associated with SRV RR?