Subject: [radext] Stephen Farrell's Yes on draft-ietf-radext-dynamic-discovery-13: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 09 Apr 2015 06:08:48 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-radext-dynamic-discovery-13: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-radext-dynamic-discovery/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have to say radext drafts are frequently very high
quality and this is no exception. Thanks.

- 2.1.1.3 - typo: s/PKS/PSK/

- 2.2, just wondering (and not suggesting you change)
but did you consider that using san.dNSName with an
accompanying policy OID could allow you to use
current CA s/w without confusing the semantics (and
without requiring the new otherName)?

- Thanks for section 6.

---

From: Stefan Winter <[email-masked]>
Date: Fri, 10 Apr 2015 08:34:01 +0200

Hello,

thanks for the compliment!

> - 2.1.1.3 - typo: s/PKS/PSK/

This is fixed in my working copy and will be in -14.

> without requiring the new otherName)?

It's a bit tricky: a RADIUS server typically has a DNS hostname (and
that may want to/need to be placed in the cert for arbitrary reasons),
and serves NAI realms on a RADIUS level - but the two are not
necessarily identical.
So there would be several sAN:DNS entries in the cert, one or more
pertaining to the hostname, one or more pertaining to the NAI realms served.
I guess a CA policy could "fix" that ambiguity by hard-wiring that the
first sAN:DNS in its certs would semantically mean "the host" and any
following ones would be "NAI realms served" but it doesn't strike me as
a terribly clean solution.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 10 Apr 2015 10:44:40 +0100

> a terribly clean solution.

Fair enough yeah - if there's other DNS names involved then
probably the otherName thing is best.

Cheers,
S.