Re: [Add] The ADD WG has placed draft-reddy-add-delegated-credentials in state "Call For Adoption By WG Issued"

[Martin Thomson <[e-mail]>]

I don't see this as ready for adoption.  I have a lot of questions that the document doesn't answer.

Why is this on the standards track?  It's just say "you could do X", where X is a standards-track document.  Informational is sufficient.

Given the relative levels of DC adoption, I'm not sure that this is going to make this deployment model much more accessible, but if OS vendors are on board, perhaps we'll see this change.

The deployment model for this is pretty narrow, given that DC is essentially a license to impersonate.  The idea of "managed" devices makes it plausible at least, but the use of specifically-delegated names is essential.  That means that the central DNS is obligated to support ACME so that it can obtain a bunch of certificates.  (That doesn't mean STAR.  Regular ACME would suffice; see below.)

The tlsdelegation SvcParam makes no sense to me.  If the client has configuration sufficient to authenticate, that can include whatever information it needs to find the right endpoint to ask for a delegation.

There is no delegation protocol defined.  Is it the case that this is intended to be proprietary in the same way that authentication is?

I don't agree with the premise that ACME doesn't work for the CPE.  That would be a simpler overall system.  It doesn't need to be STAR.  The CPE has some means of obtaining a name from its management system.  Then it uses ACME.  Maybe it uses the management system to support the challenge (for the emplacement of DNS records, say).  Maybe this part of the protocol is standardized, maybe not.

Cheers,
Martin

On Sat, Dec 9, 2023, at 14:09, IETF Secretariat wrote:
> The ADD WG has placed draft-reddy-add-delegated-credentials in state
> Call For Adoption By WG Issued (entered by Glenn Deen)
>
> The document is available at
> https://datatracker.ietf.org/doc/draft-reddy-add-delegated-credentials/
>
> Comment:
> WG Adoption call will run until December 15 2023
>
> -- 
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add