Subject: [keyassure] Using trust anchor language: draft-ietf-dane-protocol-03.txt

From: Paul Hoffman <[email-masked]>
Date: Tue, 25 Jan 2011 11:59:00 -0800

Greetings again. There was not an open issue on how TLSA deals with 
non-key information in PKIX certificates, but Phill had brought up 
strong reservations and Steve Kent responded. There was then a longish 
thread on alternatives, but Jakob and I had never clarified the 
document. Thus, we put out -03 with some proposed wording that should 
make clear that the keys in certificate associations are trust anchors. 
The side effect of making that clear is that we could wipe out all the 
wishy-washy stuff from the old 3.1.

The diffs are at 
<http://tools.ietf.org/rfcdiff?url2=draft-ietf-dane-protocol-03.txt>.

If folks are happy with this clarification, it will close some of the 
open issues that were spurred by the language in 3.1.

--Paul Hoffman

---

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 25 Jan 2011 22:50:57 -0500

Paul,
This wording looks good to me.  Very clear.
--Richard

On Jan 25, 2011, at 2:59 PM, Paul Hoffman wrote:

> Greetings again. There was not an open issue on how TLSA deals with non-key information in PKIX certificates, but Phill had brought up strong reservations and Steve Kent responded. There was then a longish thread on alternatives, but Jakob and I had never clarified the document. Thus, we put out -03 with some proposed wording that should make clear that the keys in certificate associations are trust anchors. The side effect of making that clear is that we could wipe out all the wishy-washy stuff from the old 3.1.
> 
> The diffs are at <http://tools.ietf.org/rfcdiff?url2=draft-ietf-dane-protocol-03.txt>.
> 
> If folks are happy with this clarification, it will close some of the open issues that were spurred by the language in 3.1.
> 
> --Paul Hoffman
> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure