Subject: [certid] draft slides for IETF 77

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 18 Mar 2010 13:28:36 -0600

I've been asked to make a presentation about our work to the PKIX WG
session on Monday at 15:20 Pacific. Draft slides are attached and
feedback is welcome -- this is mostly just an overview to get people
interested in reviewing the I-D and providing feedback.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 18 Mar 2010 14:05:15 -0700

At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote:
>Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms080304070605060202080805"
>

In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI.

But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with each other. A server is a machine; it is not a domain or a URI. A domain name is not a URI. And so on. Consider adding a bullet saying "this is known to be unclear".

---

From: Shumon Huque <[email-masked]>
Date: Thu, 18 Mar 2010 17:20:53 -0400

> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with each other. A server is a machine; it is not a domain or a URI. A domain name is not a URI. And so on. Consider adding a bullet s…

I think "server" here refers not to a machine or set of machines,
but to an "application service" (application server?), ie. the server
side component of a client-server protocol.

This application service can be represented in a number of different
ways: domain name, URI, SRVname, etc.

I'd just get rid of the 3rd bullet: "Domains only (no IP addresses)".
The draft isn't about domain names only, since it talks about other
identity types (although the ones mentioned usually have a domain
name component or look like one).

--Shumon.

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 18 Mar 2010 22:47:42 -0600

On 3/18/10 3:20 PM, Shumon Huque wrote:
>>> Content-Type: multipart/signed;
>>> protocol="application/pkcs7-signature"; micalg=sha1;
>>> boundary="------------ms080304070605060202080805"
>>> 
>>> I've been asked to make a presentation about our work to the PKIX
>>> WG session on Monday at 15:20 Pacific. Draft slides are attached
>>> and feedback is welcome -- this is mostly just an overview to get
>>> people interested in reviewing the I-D and providing feedback.
>> 
>> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with
>> each other. A server is a machine; it is not a domain or a URI. A
>> domain name is not a URI. And so on. Consider adding a bullet
>> saying "this is known to be unclear".
>> 
> 
> I think "server" here refers not to a machine or set of machines, but
> to an "application service" (application server?), ie. the server 

Correct.

> I'd just get rid of the 3rd bullet: "Domains only (no IP
> addresses)". The draft isn't about domain names only, since it talks
> about other identity types (although the ones mentioned usually have
> a domain name component or look like one).

Right, which is why I had thought that we were strictly talking about
domain names or things that include domain names, not IP addresses.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 19 Mar 2010 08:32:49 -0700

>> side component of a client-server protocol.

A public key listed in a certificate is associated with *something* that has access to the associated private key. The machine has access to that private key, as does the server application/daemon. If you want to make this distinction, you need to do so much more clearly in the draft.

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 19 Mar 2010 13:49:18 -0600

> interested in reviewing the I-D and providing feedback.

I've reworked the slides based on feedback. See attached.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 19 Mar 2010 13:50:42 -0600

On 3/19/10 9:32 AM, Paul Hoffman wrote:
>>>>> I've been asked to make a presentation about our work to the
>>>>> PKIX WG session on Monday at 15:20 Pacific. Draft slides are
>>>>> attached and feedback is welcome -- this is mostly just an
>>>>> overview to get people interested in reviewing the I-D and
>>>>> providing feedback.
>>>> 
>>>> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree
>>>> with each other. A server is a machine; it is not a domain or a
>>>> URI. A domain name is not a URI. And so on. Consider adding a
>>>> bullet saying "this is known to be unclear".
>>>> 
>>> 
>>> but to an "application service" (application server?), ie. the
>>> server side component of a client-server protocol.
>> 
>> Correct.
> 
> A public key listed in a certificate is associated with *something*
> that has access to the associated private key. The machine has access
> to that private key, as does the server application/daemon. If you
> want to make this distinction, you need to do so much more clearly in
> the draft.

Paul, I agree that this needs to be clearer in the I-D. I've added a
slide on this point and will discuss it at the PKIX session, then fix up
the I-D as soon as possible after Anaheim.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/