Subject: [pkix] draft-ietf-pkix-caa-03

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 20 Oct 2011 14:30:06 -0400

I am hoping to get one more rev of the draft in before the cut-off date. But
since this adds functionality (reporting) wanted to get a sketch out there).

I have updated the draft as follows:

* Removed Ben Laurie as a contributor since he was interested in the client
side enforcement capability.

* Removed the issuer bit and modified the meaning of the critical bit so
that this is now a critical bit for functions that relate only to cert
issue.

* Added a sketch of a mechanism to enable reporting as proposed by Brad
Hill.

Still to do:

* Need much more explanatory work on the reporting scheme.

* Need security considerations for reporting scheme

* The reporting scheme and the issue scheme could probably both benefit from
mandating that the syntax of the property values follows some regular
scheme, most likely the traditional HTTP/MIME syntax:

       property-value          = principal-value *( ";" parameter )
       principal-value         = dns-name | uri | quoted-string

       parameter               = attribute "=" value
       attribute               = token
       value                   = token | quoted-string

[Have to check up on my ABNF there]

This would seem to be a better approach to doing reporting than what I have
at the moment. The domain can simply specify a list of reporting formats
that it will accept data in (and possibly a list of protocols).

-- 
Website: http://hallambaker.com/