IETF Logo Mail Archive

Re: [certid] What DNS-ID if also using a DNS-SRV?

Paul Hoffman <paul.hoffman@vpnc.org> Wed, 30 June 2010 20:00 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: certid@core3.amsl.com
Delivered-To: certid@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4014C3A6924 for <certid@core3.amsl.com>; Wed, 30 Jun 2010 13:00:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.651
X-Spam-Level:
X-Spam-Status: No, score=0.651 tagged_above=-999 required=5 tests=[AWL=0.097, BAYES_50=0.001, HELO_MISMATCH_COM=0.553]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x7PvFrAruH8c for <certid@core3.amsl.com>; Wed, 30 Jun 2010 13:00:24 -0700 (PDT)
Received: from hoffman.proper.com (Hoffman.Proper.COM [207.182.41.81]) by core3.amsl.com (Postfix) with ESMTP id 85DFE3A6809 for <certid@ietf.org>; Wed, 30 Jun 2010 13:00:24 -0700 (PDT)
Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o5UK0YW2089471 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 30 Jun 2010 13:00:35 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
Mime-Version: 1.0
Message-Id: <p06240839c8515264c586@[10.20.30.158]>
In-Reply-To: <4C2BA09F.8020908@stpeter.im>
References: <p062408bbc8388055fb6d@[10.20.30.158]> <20100612013249.GA4782@isc.upenn.edu> <4C2A65B5.4080209@stpeter.im> <p06240842c8503b7c94bc@[10.20.30.158]> <20100630043158.GB26880@isc.upenn.edu> <p0624081dc8510ebfea3f@[10.20.30.158]> <07D9A6FC-C154-4125-AC33-45F2CE0C0374@apple.com> <p06240820c8513a692695@[10.20.30.158]> <4C2BA09F.8020908@stpeter.im>
Date: Wed, 30 Jun 2010 13:00:32 -0700
To: Peter Saint-Andre <stpeter@stpeter.im>, certid@ietf.org
From: Paul Hoffman <paul.hoffman@vpnc.org>
Content-Type: text/plain; charset="us-ascii"
Subject: Re: [certid] What DNS-ID if also using a DNS-SRV?
X-BeenThere: certid@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Representation and verification of identity in certificates <certid.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/certid>, <mailto:certid-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/certid>
List-Post: <mailto:certid@ietf.org>
List-Help: <mailto:certid-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/certid>, <mailto:certid-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Jun 2010 20:00:25 -0000

At 1:53 PM -0600 6/30/10, Peter Saint-Andre wrote:
>Upon further reflection, I think there are two dimensions here:
>
>1. From the client's perspective, some names are direct (provided by the
>user = DNS-ID, CN-ID, URI-ID) and some names are indirect (resolved by
>the client based on the input provided by the user = SRV-ID). This
>dimension matters for verification.
>
>2. From the service provider's persective, some names are unrestricted
>(can be used in any application = DNS-ID and CN-ID) and some names are
>unrestricted (can be used in only one kind of application = SRV-ID and
>URI-ID). This dimension matters for issuance.

That should be "...and some names are restricted (can be used in only...". But, yes, this is a good distinction.

>I'll work to formulate this distinction more carefully in text that can
>be included in the spec.

That would help implementers (and hopefully CAs) a lot.

--Paul Hoffman, Director
--VPN Consortium

v2.8.7 | Report a Bug | By Email