Subject: [pkix] draft-ietf-pkix-caa-02 and relying parties

From: Steve Schultze <[email-masked]>
Date: Sat, 10 Sep 2011 13:21:31 -0400

I see that all references to "Relying Party Authorization Sets" have
been removed.  This is a welcome change because it removes much of the
outstanding ambiguity about whether CAA is supposed to be used by
relying parties.  I wonder whether it would be worth removing the
following text as well, given that any reference to relying parties is
now irrelevant:

===
1.2
"Relying Party  A party that makes use of an application whose
operation depends on use of a Certificate for making a security
decision.

Relying Application  An application whose operation depends on use of
a Certificate for making a security decision."

2.
"In the case of a public CA that validates certificate requests as a
third party, the certificate will be typically issued under a public
root certificate embedded in one or more relevant Relying
Applications."

"Thus Relying Applications MUST NOT use failure to conform to
currently published CAA records specifying issue authorization as a
certificate validity criteria."

2.1
"Note that the above restrictions only apply to issue of certificates.
Since the validity of an end entity certificate is typically a year or
more it is quite possible that the CAA records published at a domain
will change between the issue of the certificate and verification by a
relying party."
===

To this end, might it also make sense to be even more explicit in the
abstract about how CAs go about using CAA?  Perhaps changing the
second sentence to something like:
"CAA resource records allow a public Certification Authority to check
for publication of a relevant CAA Resource Record before issuance in
order to reduce the risk of unintended certificate mis-issue."

The phrase "implement additional controls" just seems unnecessarily abstract.

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 10 Sep 2011 10:44:17 -0700

> The phrase "implement additional controls" just seems unnecessarily abstract.

+1 throughout.

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 11 Sep 2011 22:38:23 -0400

Without that text there will be people who assume that the information
presented in the issue property can be used by relying parties.

And then we will have people writing clients that rely on the data.

All the text in question does is to tell people that they should not be
using information that specifies the issue parameters as a basis for
checking certs.

On Sat, Sep 10, 2011 at 1:21 PM, Steve Schultze
<[email-masked]>wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

-- 
Website: http://hallambaker.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 12 Sep 2011 07:45:59 -0400

Since people are using CAA records for relying party purposes already
according to the initial drafts of the spec it is clear that the PKIX
document must state the limitations of the properties specified are.

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 12 Sep 2011 07:37:15 -0700

On Sep 11, 2011, at 7:38 PM, Phillip Hallam-Baker wrote:

> Without that text there will be people who assume that the information presented in the issue property can be used by relying parties.
> 
> All the text in question does is to tell people that they should not be using information that specifies the issue parameters as a basis for checking certs.

If that is the goal (and I agree that it should be), the goal can be much better reached by removing the text that Steve pointed out and, in the introduction, state something like:

The information in the CAA record is explicitly not meant for processing by anyone using the certificate to make a security decision. Applications SHOULD NOT make any security decisions based on the contents of CAA records.

--Paul Hoffman