Subject: [pkix] Review of draft-ietf-pkix-caa-13

From: Andrew Sullivan <[email-masked]>
Date: Fri, 7 Sep 2012 16:15:01 -0400

Dear colleagues,

I have read draft-ietf-pkix-caa-13.

Nit: The overwhelming consensus among the DNS weenie crowd seems to be
that RRset, not RRSet, is the right spelling.  One argument for this
is that the term seems to have been introduced in RFC 2136, and only
defined in RFC 2181.  2136 uses RRset.  Personally, I couldn't care
less.  The discussion of RRsets probably would benefit from a
reference to RFC 2181.

The description in section 4 excludes top level domains.  My
impression in Vancouver was that we didn't have such an exclusion.
Rather, we were going to leave the question of what domains one is not
allowed to climb into up to CA policy (which will presumably include
most TLDs, but possibly other things like delegation-centric domains
further down the tree).  Also, I don't see in the section 4 processing
section the explicit note that a CA can have such a policy.

Other than that, I think the updates are fine.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 7 Sep 2012 23:13:09 -0400

Thanks,

I have no prob changing the case and adding a reference.

What I thought we agreed was that CAs have to process up to the TLD but can
decide to ignore the result if doing so is in accordance with their
published policy.

This actually simplifies processing for CAs since the only time they would
need to start making exceptions is in the unlikely event that one of the
TLDs did something considered foul play. I have to follow the DNSSEC
signature chain up to the root in any case.

When a CA gets a CAA rejection they are not going to simply refuse the
request and forget all about it. Someone is going to be looking into why
there is a discrepancy. Either they are losing a sale or someone is trying
to attack them. They want to know what is going on in either case.

I don't much care about whether the processing stops when the TLD is
reached or is up to and including the TLD but does not include the root. I
don't think anything is going to be served by checking the root.

On Fri, Sep 7, 2012 at 4:15 PM, Andrew Sullivan <[email-masked]>wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

-- 
Website: http://hallambaker.com/

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 8 Sep 2012 09:17:12 -0700

On Sep 7, 2012, at 8:13 PM, Phillip Hallam-Baker <[email-masked]> wrote:

> What I thought we agreed was that CAs have to process up to the TLD but can decide to ignore the result if doing so is in accordance with their published policy.

> On Fri, Sep 7, 2012 at 4:15 PM, Andrew Sullivan <[email-masked]> wrote:
> 

You both are saying the same thing. I like Andrew's formulation better: *everything* is up to the CA to decide, so don't call out TLDs as a special thing to decide about.

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 12 Sep 2012 14:16:37 -0400

I would like to have the technical spec to require us to all go through the
motions and then decide whether to ignore or accept the result if we don't
like it.

That way there is only one part of the system that is affected if the CA
decides to exercise discretion rather than two.

On Sat, Sep 8, 2012 at 12:17 PM, Paul Hoffman <[email-masked]> wrote:

> > What I thought we agreed was that CAs have to process up to the TLD but
> can decide to ignore the result if doing so is in accordance with their
> published policy.
>
> You both are saying the same thing. I like Andrew's formulation better:
> *everything* is up to the CA to decide, so don't call out TLDs as a special
> thing to decide about.
>
> --Paul Hoffman

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 13 Sep 2012 10:46:18 -0700

> impression in Vancouver was that we didn't have such an exclusion.

Though each CA could choose their own policy with respect to checking
the TLDs, I'm not sure that's helpful.  I typically argue for
consistency and we know that more TLDs are on their way with unknown
usage patterns.  Thus, I think all CAs should check the TLDs because
we're making assumptions based on the *current* notion of TLDs, which
may not be valid soon after more and more TLDs are requested by
companies, etc.  Things typically work better when everyone does the
same, expected thing.  Even when it doesn't look like, in today's world,
it'll make a difference.

I'd like to also point out that there is a missing ) in the line from
section for that does talk about TLDs.
-- 
Wes Hardaker                                     
My Pictures:  http://capturedonearth.com/
My Thoughts:  http://pontifications.hardakers.net/

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 13 Sep 2012 10:53:07 -0700

Wes Hardaker <[email-masked]> writes:

> the TLDs, I'm not sure that's helpful.

Actually, reading the draft section in full this time I agree with
Phillip that the only thing excluded is the root.  In fact, the example
even lists the TLDs.  IE, the current text is fine with me because it is
checking the TLDs (just not the root; where I don't ever expect CAA
records to exist).
-- 
Wes Hardaker                                     
My Pictures:  http://capturedonearth.com/
My Thoughts:  http://pontifications.hardakers.net/