Subject: [therightkey] draft-tschofenig-iab-webpki-evolution-00

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 22 Oct 2013 08:49:47 +0200

Hi all,

one item that predates the pervasive surveillance debate is the
discussion about improving the public key infrastructure (but still has
relevance in this discussion, see
https://www.net-security.org/secworld.php?id=15579).

Following the workshop at NIST earlier this year the IAB and ISOC have
been reaching out to different players (and are still doing that) to
continue the conversation.

We have put together a first document that describes the different
proposals (and as you can see the level of detail available for them and
their maturity varies greately). Here is the writeup:
http://tools.ietf.org/html/draft-tschofenig-iab-webpki-evolution-00

The analysis is still a bit weak and requires more work but the
proposals are hopefully captured accurately. Let us know whether there
is something missing.

We hope that this could help to create move momentum behind certain
proposals to get them accepted by the community and widely deployed.

Ciao
Hannes

---

From: Trevor Perrin <[email-masked]>
Date: Tue, 22 Oct 2013 09:39:12 -0700

Hi Hannes,

Quick notes re TACK -

A TACK-compliant HTTPS server will present *both* the TACK extension
and an X.509 cert chain.  We envision browsers performing both TACK
*and* X.509 validation.

The details of how the "TLS server key is signed with the TSK" are
described in draft-02, section 3.2.1 (see "target_hash" and
"signature" fields).

Trevor

On Mon, Oct 21, 2013 at 11:49 PM, Hannes Tschofenig
<[email-masked]> wrote:
> _______________________________________________
> therightkey mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/therightkey