IETF Logo Mail Archive

Re: [certid] Domain Components

Michael Ströder <michael@stroeder.com> Mon, 21 June 2010 21:04 UTC

Return-Path: <michael@stroeder.com>
X-Original-To: certid@core3.amsl.com
Delivered-To: certid@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E7F923A67A7 for <certid@core3.amsl.com>; Mon, 21 Jun 2010 14:04:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.613
X-Spam-Level:
X-Spam-Status: No, score=0.613 tagged_above=-999 required=5 tests=[AWL=-0.794, BAYES_40=-0.185, MIME_8BIT_HEADER=0.3, MISSING_HEADERS=1.292]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7tM0wFAv+fMf for <certid@core3.amsl.com>; Mon, 21 Jun 2010 14:04:10 -0700 (PDT)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) by core3.amsl.com (Postfix) with ESMTP id 382A93A684E for <certid@ietf.org>; Mon, 21 Jun 2010 14:04:10 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by srv1.stroeder.com (Postfix) with ESMTP id 575CA4E079; Mon, 21 Jun 2010 23:04:15 +0200 (CEST)
X-Virus-Scanned: amavisd-new at stroeder.com
Received: from srv1.stroeder.com ([127.0.0.1]) by localhost (srv1.stroeder.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VFvnne9qzEZl; Mon, 21 Jun 2010 23:04:14 +0200 (CEST)
Received: from [10.1.0.2] (unknown [10.1.0.2]) by srv1.stroeder.com (Postfix) with ESMTP id 029804E072; Mon, 21 Jun 2010 23:04:13 +0200 (CEST)
Message-ID: <4C1FD3CD.8090009@stroeder.com>
Date: Mon, 21 Jun 2010 23:04:13 +0200
From: =?ISO-8859-1?Q?Michael_Str=F6der?= <michael@stroeder.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.10) Gecko/20100504 Lightning/1.0b1 SeaMonkey/2.0.5
MIME-Version: 1.0
References: <4C12A27D.3070308@stpeter.im> <p0624086ac8386db66483@[10.20.30.158]> <4C1CA2B8.9080103@isode.com> <p0624082ac8427d3d733f@[10.20.30.158]> <4C1CD30B.4090200@isode.com> <4C1CD73B.6000602@stroeder.com> <p0624082ec8428aeca84e@[10.20.30.158]> <4C1FA6F0.1040001@stroeder.com> <p06240828c8455b71fba1@[10.20.30.158]> <4C1FD34F.90004@stroeder.com>
In-Reply-To: <4C1FD34F.90004@stroeder.com>
X-Enigmail-Version: 1.0.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Cc: Paul Hoffman <phoffman@imc.org>, IETF cert-based identity <certid@ietf.org>
Subject: Re: [certid] Domain Components
X-BeenThere: certid@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Representation and verification of identity in certificates <certid.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/certid>, <mailto:certid-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/certid>
List-Post: <mailto:certid@ietf.org>
List-Help: <mailto:certid-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/certid>, <mailto:certid-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Jun 2010 21:04:13 -0000

Michael Ströder wrote:
> Paul Hoffman wrote:
>> It tells us that, when there are multiple ways to do things, and some of
>> those ways are known to be insecure due to repeated poor implementations,
>> we can say "don't do that" for the bad ways.
> 
> That's fine for me too.

But to make that more clear in this context: The draft should not discourage
completely using DCs in the subject-DN. It should only recommend not to encode
the server's hostname in the DCs.

Ciao, Michael.

v2.8.7 | Report a Bug | By Email