Subject: [therightkey] review of draft-laurie-pki-sunlight-03: point 9

From: Ben Laurie <[email-masked]>
Date: Mon, 17 Dec 2012 16:53:33 +0000

> (9) 3.1, " However, the log MUST refuse to publish
> certificates without a valid chain to a known root CA." seems
> to preclude any solution for self-signed certs or DNSSEC/DANE.
> Is that a good plan? Maybe if you make it a positive "must
> accept" then that'd avoid that problem? (If a good solution
> for SSCs or DANE spam is figured out later.)

I think this has to exclude SSCs and DANE until we know how to deal
with them, because otherwise a colluding CA and log could avoid blame
on the CA by logging the end certificate, signed by, say, some one-off
intermediate. This means we cannot weaken the MUST and still be able
to blame the CA.

We could add language to the effect that although this does exclude
SSCs and DANE we welcome suggestions to allow their inclusion.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 17 Dec 2012 17:04:23 +0000

> SSCs and DANE we welcome suggestions to allow their inclusion.

That'd work for me for the experimental RFC. Others may quibble
though, so it'd be great if someone did make that good suggestion

S.

> _______________________________________________
> therightkey mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/therightkey
> 
>

---

From: Ben Laurie <[email-masked]>
Date: Mon, 17 Dec 2012 18:12:15 +0000

> though, so it'd be great if someone did make that good suggestion

Done.