Subject: Re: Lookup from DNS was: X.500, LDAP Considered harmful

From: [email-masked] (Peter Gutmann)
Date: Tue, 28 Jan 2003 15:08:40 +1300

"Anders Rundgren" <[email-masked]> writes:

>Note: This is not a part of the HTTP CertStore draft, but it could be :-)

It wouldn't help any:

  Another possible alternative is the use of DNS SRV records [36].
  Unfortunately the operating system used by the user group most desperately
  in need of handholding when it comes to technical issues has no support for
  anything beyond the most basic DNS address lookups, making it impossible to
  use DNS SRV with anything but very recent Win2K and XP systems. To make
  things even more entertaining, several of the function names and some of the
  function parameters changed at various times during the Win2K phase of
  development, and the behaviour of portions of the Windows sockets API
  changed in undocumented ways to match. This leads to the unfortunate
  situation in which a Unix sysadmin can make use of DNS SRV to avoid having
  to deal with technical configuration issues, but a Windows .95 user can .t.
  As a result, we can .t usefully rely on SRV for our needs.

The "well-known location" thing was an attemp to work around this problem.

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 28 Jan 2003 08:18:00 +0100

Peter,
Although I don't know all the details concerning the SRV-records,
I think it is a mistake not to support this in a draft intended for
the future.  Phill and XKMS-gang have no such hesitations
at least, although they really want a NAPTR that does SRV+TXT
in one bite.

Anders

----- Original Message ----- 
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Tuesday, January 28, 2003 03:08
Subject: Re: Lookup from DNS was: X.500, LDAP Considered harmful

It wouldn't help any:

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 28 Jan 2003 10:20:43 +0100

Peter,
Assume that you do not "publish" certficates for everybody to
see, but still allow coded out-of-band received URLs to do lookups.

Like

http://host/csaspp?hmac=45665feedda44445a4fde3443&email=[email-masked]

Such a URL could be put in a user's EE-certificate and stored in an
e-mail client rather than storing the certificate itself.  The authentication
should stay intact over certificate renewals in order to be of any use.
Such URLs should maybe have a unique OID for the above to happen?

A regenerated key allows you to "vanish" in case your key has gone
more or less public.

Stupid, useful, possible?

Other:

A limitation in CERTSTORE is the exclusion of status information
that a client can digest in a reasonable (=locale independent) way.
Like "no such user", "no such certificate", and
"invalid authentication - expired?"  (for the suggestion above).

Anders