Re: [core] Robert Wilton's No Objection on draft-ietf-core-resource-directory-25: (with COMMENT)

["Rob Wilton (rwilton)" <[e-mail]>]

Ben, 

Thank you for the clarification/explanation.

Regards,
Rob


> -----Original Message-----
> From: Benjamin Kaduk <[e-mail]>
> Sent: 13 August 2020 19:13
> To: Rob Wilton (rwilton) <[e-mail]>
> Cc: The IESG <[e-mail]>; [e-mail];
> [e-mail]; [e-mail]; [e-mail];
> [e-mail]
> Subject: Re: Robert Wilton's No Objection on draft-ietf-core-resource-
> directory-25: (with COMMENT)
> 
> On Thu, Aug 13, 2020 at 05:44:43AM -0700, Robert Wilton via Datatracker
> wrote:
> >     5.3.  Operations on the Registration Resource
> >
> >        An endpoint should not use this interface for registrations that
> it
> >        did not create.  This is usually enforced by security policies,
> which
> >        in general require equivalent credentials for creation of and
> >        operations on a registration.
> >
> > What happens if an endpoint is managing the registration and is upgraded
> to new
> > hardware with a different certificate?  Would the updated endpoint
> expect to be
> > able to update the registration?  Or would it have to wait for the
> existing
> > registration to timeout (which could be a long time)?
> 
> Generally the authorization information in the certificate is just stored
> in the subject (i.e., subjectAltName) of the certificate, so a new
> certificate for the same name would pass the same authorization checks
> (i.e., be "equivalent credentials").
> 
> -Ben