Subject: RE: "other certs" extension straw poll

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 2 Jul 2008 07:00:32 -0700

Yes (to both)
 
The fact that some people purport to be able to construct a heuristic kludge to address a problem is not a reason not to act.
 
The problem with heuristic kludges is that they tend to be fragile and they tend to interact poorly with other systems. Most of all they are a barrier to interoperability which is what the standards process is all about.

________________________________

From: [email-masked] on behalf of Stephen Kent
Sent: Thu 6/19/2008 1:57 PM
To: [email-masked]
Subject: "other certs" extension straw poll

Folks,

Back in December, Stephen Farrell sent a message to PKIX noting a problem that had been identified in the W3C, and proposing a solution in the form of a proposed extension. He published an individual I-D at this time. There was a little discussion on the list about this proposal in January, (a total of about a dozen messages). Stephen made a presentation on his proposal at the Phildelphia meeting in March and in response to some of the comments he received, Stephen revised his proposal to include additional details.  There was agreement at the meeting that the discussion should be moved to the list, to determine of the work should proceed as a PKIX WG item, and if so, whether it would become experimental, standards track, or whatever.

The I-D, which was released at the 02 rev level after the meeting, triggered  additional discussion on the list that month, a total of 15 messages from a set of 5 individuals (including Stephen). Most of the messages in this thread were not supportive of the proposal for various reasons, e.g., argument about why one could not use the permanent identifier extension, or some other SAN, etc. I raised concerns about the lack of details for how an RP would use the data in this extension.

Stephen has asked that we conduct a straw poll on the topic of accepting this as a WG item.  I suggest that PKIX members review the current rev of the I-D (draft-farrell-pkix-other-certs-02.txt) and the messages from April, and then send a message to this list over the next two weeks.  (The straw poll will close on July 4.)

This poll is not deciding whether the I-D in its current form will be adopted, but rather whether the I-D addresses a problem that PKIX wants to address AND that the document provides a suitable basis to begin addressing the problem.

I request that poll responses be of the form:

        YES (to both questions)
        NO (to the first question)
        YES-BUT (yes to the first question, but NO to the second question)

Thanks,

Steve

---

From: "Turner, Sean P." <[email-masked]>
Date: Thu, 3 Jul 2008 11:55:48 -0400

YES (to both).
 
spt

	From: [email-masked]
[mailto:[email-masked]] On Behalf Of Stephen Kent
	Sent: Thursday, June 19, 2008 1:57 PM
	To: [email-masked]
	Subject: "other certs" extension straw poll

	Folks,

	Back in December, Stephen Farrell sent a message to PKIX noting a
problem that had been identified in the W3C, and proposing a solution in the
form of a proposed extension. He published an individual I-D at this time.
There was a little discussion on the list about this proposal in January, (a
total of about a dozen messages). Stephen made a presentation on his
proposal at the Phildelphia meeting in March and in response to some of the
comments he received, Stephen revised his proposal to include additional
details.  There was agreement at the meeting that the discussion should be
moved to the list, to determine of the work should proceed as a PKIX WG
item, and if so, whether it would become experimental, standards track, or
whatever.

	The I-D, which was released at the 02 rev level after the meeting,
triggered  additional discussion on the list that month, a total of 15
messages from a set of 5 individuals (including Stephen). Most of the
messages in this thread were not supportive of the proposal for various
reasons, e.g., argument about why one could not use the permanent identifier
extension, or some other SAN, etc. I raised concerns about the lack of
details for how an RP would use the data in this extension.

	Stephen has asked that we conduct a straw poll on the topic of
accepting this as a WG item.  I suggest that PKIX members review the current
rev of the I-D (draft-farrell-pkix-other-certs-02.txt) and the messages from
April, and then send a message to this list over the next two weeks.  (The
straw poll will close on July 4.)

	This poll is not deciding whether the I-D in its current form will
be adopted, but rather whether the I-D addresses a problem that PKIX wants
to address AND that the document provides a suitable basis to begin
addressing the problem.

	        YES (to both questions)
	        NO (to the first question)
	        YES-BUT (yes to the first question, but NO to the second
question)

	Thanks,

	Steve

---

From: Tom Gindin <[email-masked]>
Date: Thu, 3 Jul 2008 19:27:47 -0400

NO.
        The use case in #2 is unconvincing to me because existing Web 
Server certificates are identified by the heuristic: if 
SubjectAltName.DNSName is present, use it; otherwise use the Common Name 
attribute of the Subject DN.  This also works in the case where the new 
certificate comes from a different but trusted CA.  A new extension does 
not seem likely to reduce existing trust by browsers which encounter a 
valid certificate for a known host until the extension has been deployed 
for a long time and become pervasive, so that its absence can really be 
assumed to mean "they aren't really the same entity".  If the actual use 
case is to identify an SSL server as the successor of one with a different 
DNSName, the use case should say so.  If the purpose is to identify a 
server as belonging to a specific "pool" within a specific organization or 
its successors, PI is appropriate.

                Tom Gindin

Stephen Kent <[email-masked]> 
Sent by: [email-masked]
06/19/2008 01:57 PM

To
[email-masked]
cc

Subject
"other certs" extension straw poll

Folks,

Back in December, Stephen Farrell sent a message to PKIX noting a problem 
that had been identified in the W3C, and proposing a solution in the form 
of a proposed extension. He published an individual I-D at this time. 
There was a little discussion on the list about this proposal in January, 
(a total of about a dozen messages). Stephen made a presentation on his 
proposal at the Phildelphia meeting in March and in response to some of 
the comments he received, Stephen revised his proposal to include 
additional details.  There was agreement at the meeting that the 
discussion should be moved to the list, to determine of the work should 
proceed as a PKIX WG item, and if so, whether it would become 
experimental, standards track, or whatever.

The I-D, which was released at the 02 rev level after the meeting, 
triggered  additional discussion on the list that month, a total of 15 
messages from a set of 5 individuals (including Stephen). Most of the 
messages in this thread were not supportive of the proposal for various 
reasons, e.g., argument about why one could not use the permanent 
identifier extension, or some other SAN, etc. I raised concerns about the 
lack of details for how an RP would use the data in this extension.

Stephen has asked that we conduct a straw poll on the topic of accepting 
this as a WG item.  I suggest that PKIX members review the current rev of 
the I-D (draft-farrell-pkix-other-certs-02.txt) and the messages from 
April, and then send a message to this list over the next two weeks.  (The 
straw poll will close on July 4.)

This poll is not deciding whether the I-D in its current form will be 
adopted, but rather whether the I-D addresses a problem that PKIX wants to 
address AND that the document provides a suitable basis to begin 
addressing the problem.

        YES (to both questions)

Thanks,

Steve

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 8 Jul 2008 12:37:05 +0100

I know this is outside of the stated response time, but I have been on Vacation with no Internet access.

My response is YES to both questions.

This is a valid and real problem which we should address and the current draft forms a good basis to formulate a solution.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

From: [email-masked] [mailto:[email-masked]] On Behalf Of Stephen Kent
Sent: den 19 juni 2008 19:57
To: [email-masked]
Subject: "other certs" extension straw poll

Folks,

        YES (to both questions)

Thanks,

Steve

---

From: Massimiliano Pala <[email-masked]>
Date: Wed, 09 Jul 2008 09:39:53 -0400

Hi all,

although this is kinda late, after Steve's message (07,08,08), my response
is:

	YES

Later,
Max

Stephen Kent wrote:
> problem that had been identified in the W3C, and proposing a solution in 
> the form of a proposed extension. He published an individual I-D at this 
> time. There was a little discussion on the list about this proposal in 
> January, (a total of about a dozen messages). Stephen made a 
> presentation on his proposal at the Phildelphia meeting in March and in 
> response to some of the comments he received, Stephen revised his 
> proposal to include additional details.  There was agreement at the 
> meeting that the discussion should be moved to the list, to determine of 
> the work should proceed as a PKIX WG item, and if so, whether it would 
> become experimental, standards track, or whatever.
> 
> identifier extension, or some other SAN, etc. I raised concerns about 
> the lack of details for how an RP would use the data in this extension.
> 
> this as a WG item.  I suggest that PKIX members review the current rev 
> of the I-D (draft-farrell-pkix-other-certs-02.txt) and the messages from 
> April, and then send a message to this list over the next two weeks.  
> (The straw poll will close on July 4.)
> 
> adopted, but rather whether the I-D addresses a problem that PKIX wants 

-- 

Best Regards,

	Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]            [email-masked]
                                                  [email-masked]

Dartmouth Computer Science Dept               Home Phone: +1 (603) 397-3883
PKI/Trust - Office 063                        Work Phone: +1 (603) 646-9179
--o------------------------------------------------------------------------