Subject: Other certs extension

From: Stephen Farrell <[email-masked]>
Date: Fri, 04 Apr 2008 14:41:03 +0100

We briefly discussed this draft [1] in Philadelphia where
there was some support for taking it on as a WG item, as
well as some concern. I've just posted an update to the
draft that I hope might mitigate some of the concerns
expressed.

At the meeting, we agreed to discuss it on the list,
i.e. to discuss whether or not to make it a PKIX WG item,
and if so, whether it ought be experimental track or
whatever.

FWIW, I think it'd be a fine PKIX draft, and reckon
experimental is right unless its adopted for some
interesting application, which I don't see happening
right now.

So - should this be a PKIX draft? And if so, aiming
at what kind of RFC?

Cheers,
Stephen.

PS: Comments on the content are, of course, also much
appreciated. (And its still only 7 pages, incl. cruft:-)

[1] 
http://www.ietf.org/internet-drafts/draft-farrell-pkix-other-certs-02.txt

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 8 Apr 2008 09:32:32 +0100

Stephen,

You hinted in our discussions regarding this draft that the problem that this draft addresses originates from some W3C work.
Is this already covered by the use case in the draft, or could you elaborate?

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of Stephen Farrell
> Sent: den 4 april 2008 15:41
> To: pkix
> Subject: Other certs extension
>
>
>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 08 Apr 2008 13:28:53 +0100

> Is this already covered by the use case in the draft, or could you elaborate?

Hi Stefan,

The W3C reference [1] is in the draft. Basically, that was a proposal
for a "safe" form editor for browsers, but when the W3C group thrashed
the details, it turned out to be somewhat unsafe since it was proposed
to be based on mapping (parts of) names from certs. That's probably not
that visible from the URL below, without diving into the WSC mail
archive. I believe that with the other certs extension, one could (in
future) build such a "safe" form editor into a browser.

Stephen.

[1] http://www.w3.org/2006/WSC/wiki/SafeWebFormEditor

---

From: "Kemp, David P." <[email-masked]>
Date: Tue, 8 Apr 2008 15:26:40 -0400

"Some applications that associate state information with public key
   certificates can benefit from a way to link together a set of
   certificates belonging to the same end entity that can safely be
   considered to be equivalent for the purposes of referencing that
   application state information.  This memo defines a certificate
   extension that supports such linkage that can allow applications to
   establish the required linkage without introducing a new application
   protocol data unit."

Don't such extensions already exist, i.e. the Subject Alt Name extension
and/or RFC 4043 (Permanent Identifier)?  If multiple devices having
different keys are used to load-balance a single service, for example,
wouldn't each device's cert contain the same UUID or other provider ID
in SAN or PI?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stefan Santesson
Sent: Tuesday, April 08, 2008 4:33 AM
To: Stephen Farrell; pkix
Subject: RE: Other certs extension

Stephen,

You hinted in our discussions regarding this draft that the problem that
this draft addresses originates from some W3C work.
Is this already covered by the use case in the draft, or could you
elaborate?

Stefan Santesson
Senior Program Manager