Subject: [Sip] FW: FW: WGLC on domain-certs and eku

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Fri, 29 Feb 2008 16:11:15 +0100

For info, some comments from Steven Kent of PKIX on the eku document

Keith 

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Monday, February 25, 2008 5:49 PM
To: DRAGE, Keith (Keith)
Cc: [email-masked]; Dean Willis
Subject: Re: FW: [Sip] WGLC on domain-certs and eku

Keith,

Here are a few comments on the SIP-EKU I-D:

	- the document does not seem to state explicitly that the cert
SHOULD/MUST contain a SAN with a DNS name. The references to the domain
name in section 2 never say where the name should appear. Even if this
is discussed separately in the SIP domain cert I-D (I'm on a flight now
and don't have access to the net to grab that I-D, so I don't now for
sure), it should be reiterated here, so that a reader can be reminded of
whatever constraints apply to where the domain name appears.

	- section 3 contains references to other EKUs, ones defined more
broadly for TLS use, but it refers to them only by name. Some references
and a brief note on he usual semantics associated with these EKUs would
make this section more self-contained.

	- section 4 says "If the certificate contains the
id-kp-sipDomain EKU extension, then the certificate MUST be accepted as
valid for use as a SIP certificate."  This probably should be reworded
as cert path validation is a complex process and the presence of this
EKU value does not cause the cert to be "valid" in a larger context.

	 - the secruity considerations section is pretty thin. For
example, I'd expect some discussion the implications of the various
"local policy" bullets in section 4, and why they are there (e.g., for
backward compatibility).

Steve
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip