Subject: "other certs" extension straw poll

From: Stephen Kent <[email-masked]>
Date: Thu, 19 Jun 2008 13:57:04 -0400

Folks,

Back in December, Stephen Farrell sent a message to PKIX noting a 
problem that had been identified in the W3C, and proposing a solution 
in the form of a proposed extension. He published an individual I-D 
at this time. There was a little discussion on the list about this 
proposal in January, (a total of about a dozen messages). Stephen 
made a presentation on his proposal at the Phildelphia meeting in 
March and in response to some of the comments he received, Stephen 
revised his proposal to include additional details.  There was 
agreement at the meeting that the discussion should be moved to the 
list, to determine of the work should proceed as a PKIX WG item, and 
if so, whether it would become experimental, standards track, or 
whatever.

The I-D, which was released at the 02 rev level after the meeting, 
triggered  additional discussion on the list that month, a total of 
15 messages from a set of 5 individuals (including Stephen). Most of 
the messages in this thread were not supportive of the proposal for 
various reasons, e.g., argument about why one could not use the 
permanent identifier extension, or some other SAN, etc. I raised 
concerns about the lack of details for how an RP would use the data 
in this extension.

Stephen has asked that we conduct a straw poll on the topic of 
accepting this as a WG item.  I suggest that PKIX members review the 
current rev of the I-D (draft-farrell-pkix-other-certs-02.txt) and 
the messages from April, and then send a message to this list over 
the next two weeks.  (The straw poll will close on July 4.)

This poll is not deciding whether the I-D in its current form will be 
adopted, but rather whether the I-D addresses a problem that PKIX 
wants to address AND that the document provides a suitable basis to 
begin addressing the problem.

I request that poll responses be of the form:

	YES (to both questions)
	NO (to the first question)
	YES-BUT (yes to the first question, but NO to the second question)

Thanks,

Steve

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 20 Jun 2008 09:08:59 +0100

YES (to both).

I think for balance I should point out that there have also been
folks who've been supportive of this as well as those, (presumably
including Steve:-), who have concerns. Basically, its a simple
proposal to handle a particular problem for consumers of PKI,

Stephen.

Stephen Kent wrote:
> problem that had been identified in the W3C, and proposing a solution in 
> the form of a proposed extension. He published an individual I-D at this 
> time. There was a little discussion on the list about this proposal in 
> January, (a total of about a dozen messages). Stephen made a 
> presentation on his proposal at the Phildelphia meeting in March and in 
> response to some of the comments he received, Stephen revised his 
> proposal to include additional details.  There was agreement at the 
> meeting that the discussion should be moved to the list, to determine of 
> the work should proceed as a PKIX WG item, and if so, whether it would 
> become experimental, standards track, or whatever.
> 
> triggered  additional discussion on the list that month, a total of 15 
> messages from a set of 5 individuals (including Stephen). Most of the 
> messages in this thread were not supportive of the proposal for various 
> reasons, e.g., argument about why one could not use the permanent 
> identifier extension, or some other SAN, etc. I raised concerns about 
> the lack of details for how an RP would use the data in this extension.
> 
> Stephen has asked that we conduct a straw poll on the topic of accepting 
> this as a WG item.  I suggest that PKIX members review the current rev 
> of the I-D (draft-farrell-pkix-other-certs-02.txt) and the messages from 
> April, and then send a message to this list over the next two weeks.  
> (The straw poll will close on July 4.)
> 
> adopted, but rather whether the I-D addresses a problem that PKIX wants 
> to address AND that the document provides a suitable basis to begin 
> addressing the problem.
>

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 20 Jun 2008 11:38:32 -0400

"The use of the new extension provides a way for the CA to signal to

   the application that the same end entity is involved, regardless of

   name changes.  The new extension could also allow the web site

   operator to more easily change CA when renewing its certificate."

YES-BUT.

As previously discussed, I believe that the way for a CA to signal that
the same entity is involved is to use the same unique name for that
entity, regardless of any changes in other (e.g., DNS-based) names also
assigned to that entity by that CA or other CAs.

Dave

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Kent
Sent: Thursday, June 19, 2008 1:57 PM
To: [email-masked]
Subject: "other certs" extension straw poll

Folks,

        YES (to both questions)

        YES-BUT (yes to the first question, but NO to the second
question)

Thanks,

Steve