Subject: Re: [secdir] Please review draft-ietf-capwap-protocol-specification's use of certificates

From: [email-masked] (Peter Gutmann)
Date: Tue, 08 Jan 2008 22:57:27 +1300

As invariably happens with these things, there are a pile of off-list private
threads going on that look at this.  I thought the following comment was
rather interesting, since I'm currently responsible for stirring things up :-)
I've forwarded it with the author's permission.

Peter.

-- Snip --

Stephen Kent <[email-masked]>:

>I do not agree with the suggestion that we should back off on what
>constitutes good practice just because a specific piece of (open source)
>software has limitations in what it supports relative to the standards it
>purportedly implements.

"do not agree that we should back off ... good practice just because open
source software has limitatioms..." - Well what about PKIX's non-use of
modern ASN.1 for almost ten years due to "no freeware modern ASN.1
compiler available"?? Sigh. Talk about inconsistency.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 8 Jan 2008 09:52:20 -0500

>compiler available"?? Sigh. Talk about inconsistency.

These are not inconsistent statements, Peter.

Russ argued for some time that we ought not move to the newer ASN.1, 
which offered minor improvements in expressive ability, when the only 
open source ASN.1 compilers were for the older version.  He is now 
making a similar argument about the importance of open source 
software and adoption of PKI technology, using OpenSSL as the 
exemplar.

In the case of ASN.1 compilers, there were several options available 
to implementers, and more than  one of them  was very good. (One was 
commissioned by the U.S  DoD and made available for use in systems 
provided to them.)  In the case of OpenSSL, it is regarded as the de 
facto open source crypto and cert processing software, and it has had 
numerous errors. So, while I agreed with Russ's position on ASN.1, I 
am less sanguine with suggestions that we tailer our view of what 
constitutes good practice based on OpenSSL capabilities.

Steve

---

From: Sam Hartman <[email-masked]>
Date: Tue, 08 Jan 2008 10:20:57 -0500

I think the discussion of capwap and the use of CN has served its
purpose at least for the secdir list.  Unless there are significant
new arguments I'll call the discussion closed as far as secdir is
concerned.

I want to thank everyone who participated; we got a lot of great
comments and I think we found ways of recommending improvements to the
capwap working group while maintaining support for market reality.

--Sam