Subject: [Dance] Benjamin Kaduk's Yes on charter-ietf-dance-00-01: (with COMMENT)

From: Benjamin Kaduk via Datatracker <[email-masked]>
Date: Wed, 08 Sep 2021 10:25:45 -0700

Benjamin Kaduk has entered the following ballot position for
charter-ietf-dance-00-01: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-dance/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

    The DNS namespace, together with DNSSEC, forms the most
    widely-recognized namespace and authenticated lookup mechanism on the
    Internet. DANE builds on this authenticated lookup mechanism to enable
    public key-based TLS authentication which is resilient to impersonation,
    but only for TLS server identities.

We might reference RFC 6698 for DANE.

OVERLY PEDANTIC NITS

    The process of establishing trust in public-key-authenticated
    identity typically involves the use of a Public Key Infrastructure
    (PKI), and a shared PKI root of trust between the parties exchanging
    public keys.

"shared PKI root of trust" seems to imply that both parties have
credentials that chain up to the same root of trust (or at least that
the level of trust in the root is shared between parties), which need
not be the case.  In principle the parties can use credentials anchored
at different roots of trust, so long as the verifier is willing to use
the corresponding root of trust for this purpose.  So we might say
instead "and a root of trust deemed valid by the entity validating the
authenticated identity".  Or we could ignore it, and try to not be
overly pedantic.

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 08 Sep 2021 10:31:44 -0700

> We might reference RFC 6698 for DANE.

That's a good point.

> authenticated identity".  Or we could ignore it, and try to not be

Although that's a very valid point, I'd argue we should aim for more
readable over perfect and I'm personally thinking we should leave the
existing, easier to understand, language in place.
-- 
Wes Hardaker
USC/ISI

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 9 Sep 2021 20:46:11 -0700

> existing, easier to understand, language in place.

Right, that's why I put the "overly pedantic" in "overly pedantic nits" :)

-Ben