Subject: [mile] CN-ID vs DNS-ID for RID over HTTPS

From: Brian Trammell <[email-masked]>
Date: Mon, 23 Jan 2012 17:56:11 +0100

Greetings, all,

In addressing Gen-ART review comments on rfc6046-bis, a question about certificates identifying RID endpoints has arisen.

We certainly prefer DNS-ID (per RFC 6125) identifiers for X.509 certificates identifying RID systems; however, does anyone see a need to support "legacy" CN-ID (i.e., to support older certificate authorities) for RID? The preference is _not_ to support CN-ID (see section 2.3 of RFC 6125 for reasons why) in new protocols.

Best regards,

Brian (as 6046-bis author)

---

From: <[email-masked]>
Date: Mon, 23 Jan 2012 11:04:36 -0600

Brian,

I see no reason to include legacy support if we have a preference to NOT support it going forward. This could lead to unneeded confusion and adds no value from my perspective.

Thanks.

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Brian Trammell <[email-masked]<mailto:[email-masked]>>
Date: Mon, 23 Jan 2012 10:56:11 -0600
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [mile] CN-ID vs DNS-ID for RID over HTTPS

Greetings, all,

Best regards,

Brian (as 6046-bis author)
_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile

---

From: <[email-masked]>
Date: Wed, 25 Jan 2012 09:45:16 -0500

Brian,

I agree that we should not need to support CN-IDs.  I reached out to the RSA lead PKI Architect who has tons of recent experience with a vast array of PKI implementations to ask her about the level of support for DNS-IDs.   Essentially, she does not think it would be a hurdle for a new product deployment.  Here is her response:

---------
As a practical matter, DNS-ID has been supported by most CAs for a number of years now.  If a CA system does not support the DNS-ID, I would suggest that that CA be encouraged/forced to live up to the standard rather than perpetuate possible security weaknesses.  Because of this, I believe that legacy support should not be extended.

Regards,

Karen Reinhardt
Lead PKI Architect, Professional Services
RSA, The Security Division of EMC
-------

The guidance in RFC6125 is very good, but I am not sure we will need to provide that support unless people in the IESG see older CAs that do not support DNS-IDs still.  RFC6125 cites that this may only be an issue for older CAs and allowed for support when necessary for that reason.  RFC6125 was published in March 2011 and is general to all TLS connections.  Our use case is one that deals with (potentially) very sensitive information.  If it was allowed, I would add a security consideration to have peers include this in their policy reviews when developing sharing agreements.  This would help them to understand it is a control they should be aware of when sharing information.

Thank you,
Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, January 23, 2012 12:05 PM
To: [email-masked]; [email-masked]
Subject: Re: [mile] CN-ID vs DNS-ID for RID over HTTPS

Brian,

Thanks.

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Greetings, all,

Best regards,