Subject: Re: [Acme] WG meeting at IETF 93

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 1 Jul 2015 12:50:42 -0400

I would like to present OmniPublish which is the protocol I was working on
before ACME came along.

It is not exactly the same as ACME but I think it is important to bear both
approaches in mind because we are going to end up requiring both and I
think they should both work in the same way and be implemented in the same
style.

Consider SMTP and NNTP, they do different things but they do them in the
same way. The protocols are very similar under the covers which made it
easy to write mail/news readers.

ACME is a replacement for the CA interface. The reason I did not propose
doing that was that IETF has tried that on 3 separate occasions without
success to date and W3C has tried it once.

OmniPublish is designed as a meta-protocol that provides client
applications with a one stop shop for all their network configuration and
credential needs.

When a Web Service starts up it needs to have a number of separate
configurations performed:

  * Get a WebPKI cert
  * Get DNS parameters entered
  * Open firewall ports
  * Register contact info in a directory (Jabber, etc)

Traditionally this information has to be hand configured separately. And
this has major consequences for reliability. One of the main reasons I am
skeptical about DANE is that we have three levels of configuration that can
go wrong and today we expect all three to be done by hand, the DNSSEC
config, the DANE entries for the server and the server itself.

The only way I am going to trust that data is if those processes are
automated. Hence the idea behind OmniPublish.

On Tue, Jun 30, 2015 at 4:12 PM, Ted Hardie <[email-masked]> wrote:

> Just to bump this up on people's lists, Rich and I will put up a
> preliminary agenda next Monday.  If you want time for something other than
> draft-barnes-acme, please let us know.
>
> thanks,
>
> Ted and Rich
>
> On Fri, Jun 26, 2015 at 10:54 AM, Ted Hardie <[email-masked]> wrote:
>
>> Howdy,
>>
>> As you've seen from the IESG announcement, ACME has been approved as a
>> working group, so our meeting in Prague will be as a working group rather
>> than a BoF.  The IETF agenda is still tentative, but we're currently
>> scheduled for Thursday, July 23rd, 15:20-17:20, in Karlin I/II.  (There is
>> still a chance that will change, though, so please do not tailor travel to
>> just that time frame!)
>>
>> Our charter lists draft-barnes-acme as a starting point, and Rich and I
>> are asking the authors to produce an update for the meeting.  We expect
>> some of the working group time in Prague to be a document review/discussion
>> of that draft.
>>
>> If you have other agenda items you'd like to request time for, please
>> send them to the list.
>>
>> thanks,
>>
>> Ted and Rich
>>
>
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>
>

---

From: John Mattsson <[email-masked]>
Date: Mon, 6 Jul 2015 10:38:17 +0000

Howdy,

I request time to present https://datatracker.ietf.org/doc/draft-mattsson-acme-use-cases/ (focusing on the tunnelling illustrated in Figure 3).

I think there need be be a discussion on how ACME is supposed to work in domains with more than one web server. During the BoF Eric Rescorla briefly discussed how to tunnel the ACME protocol, i.e. the scenario illustrated in Figure 3 of draft-mattsson-use-cases. In this scenario the domain owner may like to put restrictions on the issued certificate (e.g. only certain subdomain and limited lifetime). To my understading, draft-barnes-acme would only allow the domain owner to forward or block the CSR from the web server, and then forward of block the issued certificate from the CA. And to my understanding, there is no mechanism to suggest the lifetime of the certificate.

Cheers,
John

On 26 Jun 2015, at 19:54, Ted Hardie <[email-masked]<mailto:[email-masked]>> wrote:

Howdy,

As you've seen from the IESG announcement, ACME has been approved as a working group, so our meeting in Prague will be as a working group rather than a BoF.  The IETF agenda is still tentative, but we're currently scheduled for Thursday, July 23rd, 15:20-17:20, in Karlin I/II.  (There is still a chance that will change, though, so please do not tailor travel to just that time frame!)

Our charter lists draft-barnes-acme as a starting point, and Rich and I are asking the authors to produce an update for the meeting.  We expect some of the working group time in Prague to be a document review/discussion of that draft.

If you have other agenda items you'd like to request time for, please send them to the list.

thanks,

Ted and Rich
_______________________________________________
Acme mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/acme

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 6 Jul 2015 10:14:10 -0400

Another point I think should be considered on the agenda is how to use JOSE
in the spec.

I think it would be a very good idea to adopt the approach Mike Jones and
myself have been suggesting of using JOSE without base64 armoring for
authenticating requests and responses at the Web Service level.

http://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00

I really hope that ACME is not going to be the last JSON based security
spec IETF does and I would really like all the specs to end up with
something approaching a uniform style.

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 6 Jul 2015 21:06:21 +0000

> http://tools.ietf.org/html/draft-jones-jose-jws-signing-input-options-00

The WG should spend some time on this; it's on the agenda. For the benefit of the list, I asked Mike off-line if he could attend the WG meeting.