Subject: [xmpp] I-D Action: draft-ietf-xmpp-posh-04.txt

From: [email-masked]
Date: Mon, 23 Feb 2015 15:05:42 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Extensible Messaging and Presence Protocol Working Group of the IETF.

        Title           : PKIX over Secure HTTP (POSH)
        Authors         : Matthew Miller
                          Peter Saint-Andre
	Filename        : draft-ietf-xmpp-posh-04.txt
	Pages           : 15
	Date            : 2015-02-23

Abstract:
   Experience has shown that it is extremely difficult to deploy proper
   PKIX certificates for TLS in multi-tenanted environments.  As a
   result, domains hosted in such environments often deploy applications
   using certificates that identify the hosting service, not the hosted
   domain.  Such deployments force end users and peer services to accept
   a certificate with an improper identifier, resulting in obvious
   security implications.  This document defines two methods that make
   it easier to deploy certificates for proper server identity checking
   in non-HTTP application protocols.  While these methods developed for
   use in the Extensible Messaging and Presence Protocol (XMPP) as a
   Domain Name Association (DNA) prooftype, they might also be usable in
   other non-HTTP application protocols.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-xmpp-posh/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-xmpp-posh-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-xmpp-posh-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: ⌘ Matt Miller <[email-masked]>
Date: Mon, 23 Feb 2015 16:08:55 -0700

This revision should address all of Ben's outstanding concerns.

Thanks!

- -- 
- - m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

On 2/23/15 4:05 PM, [email-masked] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Extensible Messaging
> and Presence Protocol Working Group of the IETF.
> 
> Title           : PKIX over Secure HTTP (POSH) Authors         :
> Matthew Miller Peter Saint-Andre Filename        :
> draft-ietf-xmpp-posh-04.txt Pages           : 15 Date            :
> 2015-02-23
> 
> Abstract: Experience has shown that it is extremely difficult to
> deploy proper PKIX certificates for TLS in multi-tenanted
> environments.  As a result, domains hosted in such environments
> often deploy applications using certificates that identify the
> hosting service, not the hosted domain.  Such deployments force end
> users and peer services to accept a certificate with an improper
> identifier, resulting in obvious security implications.  This
> document defines two methods that make it easier to deploy
> certificates for proper server identity checking in non-HTTP
> application protocols.  While these methods developed for use in
> the Extensible Messaging and Presence Protocol (XMPP) as a Domain
> Name Association (DNA) prooftype, they might also be usable in 
> Please note that it may take a couple of minutes from the time of
> submission until the htmlized version and diff are available at
> tools.ietf.org.
> 
> _______________________________________________ xmpp mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/xmpp
>

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 25 Feb 2015 13:59:09 -0600

I think this version looks good to go to the IESG.

In my chair opinion, the changes in this version are not substantial 
enough to require a new WGLC (and have been published on the list.) Do 
the authors agree?

It occurs to me to wonder if we should submit posh and DNA (currently in 
WGLC) together as a package, or submit them separately as they are 
ready. Thoughts?

/Ben

On 23 Feb 2015, at 17:08, ⌘ Matt Miller wrote:

> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp

---

From: ⌘ Matt Miller <[email-masked]>
Date: Wed, 25 Feb 2015 13:11:16 -0700

On 2/25/15 12:59 PM, Ben Campbell wrote:
> In my chair opinion, the changes in this version are not 
> substantial enough to require a new WGLC (and have been published 
> on the list.) Do the authors agree?
> 

I agree.

> It occurs to me to wonder if we should submit posh and DNA 
> (currently in WGLC) together as a package, or submit them 
> separately as they are ready. Thoughts?
> 

Personally, I think it's fine to submit POSH before DNA.  DNA has
normative dependencies on POSH, but not the reverse.

What does our AD think?

- -- 
- - m&m