Subject: [sidr] a proposed syntax change to the format of trust anchors

From: Stephen Kent <[email-masked]>
Date: Mon, 8 Dec 2008 14:44:46 -0500

The current  res-cert profile defines a format for trust anchors 
based on self-signed certs (either in isolation or embedded in a CMS 
signed object).

There is some work ongoing in the PKIX WG addressing trust anchor 
management. Much of this work is not directly applicable to the SIDR 
context, as the PKIX work is initially focusing on push-based 
management of TAs, whereas the SIDR model is pull-based. However, we 
have tentative agreement on a base format for trust anchors, and that 
format could be used in the SIDR context, with only a very minor 
change to our current syntax. Specifically, the base format allows 
for a SEQUENE of self-signed certs (or other representations about 
which we do not care) instead of a single self-signed cert.

If there are no objections, I'd like to ask Geoff to change the TA 
text in his document to adopt this format.

Steve
_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Geoff Huston <[email-masked]>
Date: Tue, 9 Dec 2008 08:42:50 +1100

On 09/12/2008, at 6:44 AM, Stephen Kent wrote:

> have tentative agreement on a base format for trust anchors, and  
> that format could be used in the SIDR context, with only a very  
> minor change to our current syntax. Specifically, the base format  
> allows for a SEQUENE of self-signed certs (or other representations  
> about which we do not care) instead of a single self-signed cert.
>

Thanks Steve,

As I understand your proposal, the CMS packaging remains, but it  
allows for a sequence of self-signed certs in which, in this profile,  
the sequence has a single member.

have I got that right?

regards,

    Geoff

---

From: Stephen Kent <[email-masked]>
Date: Mon, 8 Dec 2008 17:09:03 -0500

>>...
>allows for a sequence of self-signed certs in which, in this 
>profile, the sequence has a single member.
>
>have I got that right?
>
>regards,
>
>    Geoff

Yes, Geoff, absolutely correct.

Steve

---

From: George Michaelson <[email-masked]>
Date: Tue, 9 Dec 2008 08:50:22 +1000

> Yes, Geoff, absolutely correct.

I think that converging our TA model with TAMP is a very good idea,  
and I support this proposal.

-George