Subject: [sidr] draft-newton-sidr-policy-qualifiers-01

From: Matthew Lepinski <[email-masked]>
Date: Mon, 11 Mar 2013 09:48:16 -0400

I have now read this document. [Also, thanks to the document authors,
the -01 version is a significant improvement over the -00 version]

At the meeting, both APNIC and ARIN said they would like to put these
URIs into certificates they issue.

This appears to place no burden whatsoever on the relying party. (And
some relying parties might actually find these URIs useful for finding
applicable CPS documents.)

This seems like quite a reasonable document, and I do not anticipate
that it would take a lot of working group cycles to process this
document. I would, therefore, support adoption of this document by the
working group.

- Matt Lepinski

---

From: Andy Newton <[email-masked]>
Date: Mon, 11 Mar 2013 13:54:37 +0000

>document. I would, therefore, support adoption of this document by the

Thank you Matt. And since you beat me to getting a message to the list
regarding the adoption of this draft, I would like to ask the working
group to adopt this draft as a work item.

-andy

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Mon, 11 Mar 2013 09:56:55 -0400

I support WG adoption of this draft.

~Carlos

On 3/11/13 9:54 AM, Andy Newton wrote:
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Sean Turner <[email-masked]>
Date: Mon, 11 Mar 2013 10:36:03 -0400

+1

spt

---

From: Arturo Servin <[email-masked]>
Date: Mon, 11 Mar 2013 11:38:59 -0300

I have read and support.

Regards,
as

---

From: "Roque Gagliano (rogaglia)" <[email-masked]>
Date: Mon, 11 Mar 2013 16:52:47 +0000

I support this document and I volunteer review. 

I suffered this problem in a previous job.

Also CPS URIs in certificates are common practice. See the "Certificate Policies" extension from my personal certificate issued by Verisign where a CPS pointer qualifier (id-qt-cps) is present:

        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.1
                  CPS: https://www.verisign.com/rpa

Obs: CPS OID =  1.3.6.1.5.5.7.2.1 (id-qt-cps)

Roque

---

From: George Michaelson <[email-masked]>
Date: Mon, 11 Mar 2013 12:56:26 -0400

I suport this document being adopted.

-George

---

From: Randy Bush <[email-masked]>
Date: Mon, 11 Mar 2013 10:14:58 -0700

> I suport this document being adopted.

as do i.  we should definitely discuss it.

but, as stated previously, i have serious reservations about it.  at a
minimum, the sec cons must say that the uri can be an attack vector.

randy

---

From: John Curran <[email-masked]>
Date: Mon, 11 Mar 2013 18:28:20 +0000

> minimum, the sec cons must say that the uri can be an attack vector.

Such as the following?

"RPKI Certificates contain URIs, all of which have potential of being attack 
 vectors. An additional policy-qualifier URI adds one more potential vector 
 for attack, which should be considered before dereferencing it." 

(or should the first statement above go into the RPKI framework document?)

/John

---

From: Stephen Kent <[email-masked]>
Date: Mon, 11 Mar 2013 15:25:45 -0400

I also support adoption of this draft.

Steve

---

From: Danny McPherson <[email-masked]>
Date: Mon, 11 Mar 2013 15:52:22 -0400

Me too...

---

From: Mark Kosters <[email-masked]>
Date: Mon, 11 Mar 2013 19:53:51 +0000

I do as well.

Mark

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 11 Mar 2013 15:36:42 +0000

> group to adopt this draft as a work item.

On behalf of SIDR chairs I am starting 3 weeks WG acceptance call on 
this document.