Subject: Re: [certid] representation and verification of identity in certificates

From: Simon Josefsson <[email-masked]>
Date: Wed, 10 Mar 2010 09:29:13 +0100

Peter Saint-Andre <[email-masked]> writes:

> A small, informal design team has been working on an I-D that attempts
> to define recommended procedures for representing and verifying server
> identities in X.509 certificates intended for use in applications that
> employ TLS. We have just published version -03 of that I-D:
>
> http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-03

Thanks for this document, it is useful.

Did you consider discussing name check rules for OpenPGP based
certificate validation as well?  That is currently an underspecified
area, and GnuTLS had to just pick one reasonable algorithm here.

If this is not in scope, I think it would help to clarify the scope of
your document if the term 'X.509' was mentioned in the abstract and in
section '1.2 Scope'.

/Simon

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 10 Mar 2010 08:37:11 -0800

>your document if the term 'X.509' was mentioned in the abstract and in

Let's keep this to PKIX (not X.509, which lacks some of the alt attributes needed in the discussion) and also not include OpenPGP. Note, however, that we might learn something from the successes and failures in the OpenPGP world.

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 10 Mar 2010 09:47:00 -0700

On 3/10/10 9:37 AM, Paul Hoffman wrote:
>> certificate validation as well?  That is currently an
>> underspecified area, and GnuTLS had to just pick one reasonable
>> algorithm here.
>> 
>> If this is not in scope, I think it would help to clarify the scope
>> of your document if the term 'X.509' was mentioned in the abstract
>> and in section '1.2 Scope'.
> 
> Let's keep this to PKIX (not X.509, which lacks some of the alt
> attributes needed in the discussion) and also not include OpenPGP.
> Note, however, that we might learn something from the successes and
> failures in the OpenPGP world. 

The authors have consciously limited the scope of the document, at times
only because wiser heads insisted on it. While related problems are
interesting (IPsec, OpenPGP, client certs), I think we'll need to work
on those in separate documents. Perhaps someday we'll have a grand
unified theory of identity in certs/keys/etc., but not yet. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/