Subject: Re: [stir] comment on draft-jennings-stir-rfc4474bis-00

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 1 Nov 2013 16:25:36 +0000

I suspect Rich is right that we are in a position to make credible
recommendations about credential distribution and management, but that if
we are serious about tying these credential structures to the national
authorities, then it will be those authorities and their various industry
bodies that make the ultimate decisions here. Consequently the situation
is fluid, and difficult to anticipate. Which is a good reason for a
modular design.

Jon Peterson
Neustar, Inc.

On 10/31/13 3:28 PM, "Richard Shockey" <[email-masked]> wrote:

>I would strongly caution that issues surrounding the E.164 numbering plan
>and the databases that enable them are in fact national specific issues
>enabled in law. 
>
>We only may be able to make Recommendations on implementation of STIR key
>management structures we may not be able to impose them.
>
>This is a fluid situation at this point. To be blunt I'm not sure what is
>the best recommendation or course of action we can make to the NRA's.  As
>you point out the record on PKI is mixed.  That said number assignment
>authorities and those that receive the resource are a more limited and
>restricted subset and that may actually work to our advantage.
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Stephen Kent
>Sent: Thursday, October 31, 2013 4:17 PM
>To: Peterson, Jon; [email-masked]
>Subject: Re: [stir] comment on draft-jennings-stir-rfc4474bis-00
>
>Jon,
>
>> I think we're mostly on the same page here, though the question of
>> whether something like web PKI is still relevant largely depends on
>> how real we think DANE is. No question that it would be better, and
>> that the warts of web PKI grow increasingly ugly. But I haven't heard
>> a lot of enthusiasm from browser vendors, say, about DANE (I haven't
>> taken this temperature super recently, though, so that may just be
>> stale information). I also think that despite its warts, the world is
>> still better off with web PKI today than it would be if it all went away
>with nothing to replace it.
>>
>> I'm not sure I could predict with total certainty where the market is
>> going to go with all this. When I'm in that position, I tend to favor
>> a certain amount of flexibility rather than gambling it all on one
>> number on the roulette wheel.
>>
>How about a compromise; we strong recommend DANE, and characterize the
>WebPKI as a fallback, with caveats.
>
>Steve
>_______________________________________________
>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir
>

---

From: Stephen Kent <[email-masked]>
Date: Mon, 04 Nov 2013 16:54:59 -0500

Jon,

> is fluid, and difficult to anticipate. Which is a good reason for a
Modular is good.

Vague is not.

I found the descriptions of the actors to be so vague that it was very hard
for me to figure out what instantiations of modules were valid, invalid, 
preferred, etc.

Steve