Subject: Re: [dane] cert authority authz (was: Starting WGLC on: draft-ietf-dane-use-cases-02)

From: =JeffH <[email-masked]>
Date: Mon, 16 May 2011 09:21:49 -0700

Paul Hoffman replied on Fri, 13 May 2011 13:55:04 -0700:
 >
 > I'd mused..
 >
 >> Of course, one would have to then write a spec similar to
 >> draft-hallambaker-donotissue specifying how to accomplish the
 >> CA-pre-cert-issuance-check using DANE DNS records. And then there's the
 >> two-specs-solving-same-problem thing to either sort out or let dangle.
 >
 > I disagree. Saying "If Charlie wants to do X, here is a way to fulfill that
 > desire" is quite different than "If Charlie wants to do X, here is the only
 > acceptable method." I'm not saying we will actually be able to meet the use
 > case in the protocol document; I just don't see that it is impossible so
 > therefore we shouldn't even think of listing the use case.

Sorry, to clarify, all I'd meant by that musing was that if one desires to 
actually explicitly address the CA-pre-cert-issuance-check use case in the DANE 
WG context, then one would need to explicitly spec it out (whether in the 
present DANE protocol spec, or in a separate spec), and then if so, we (the 
greater IETF community et al) have the two-specs-solving-same-problem thing 
(given that it looks like CAA will get a RRTYPE issued) to either sort out or 
let dangle.

=JeffH