Re: [dane] Extending TLSA RFC to operate with TLS's new raw public keys

[Viktor Dukhovni <[e-mail]>]

On Mon, Jun 02, 2014 at 03:14:31PM +0100, Stephen Farrell wrote:

> Can we try get this one settled soon, at least in terms of
> any changes to draft-ietf-tls-oob?
> 
> The core WG have been waiting on that for quite a while as
> its a normative dependency for CoAP.
> 
> (So, dane WG chairs - if you could propose a consensus call
> for the action to take that'd be great and we can move on.)

Could you perhaps restate the questions to be considered?

    I think John Gilmore posed two questions:

    * What is the representation of oob public keys in DANE TLSA
      records.  Proposed "3 1 X".

      [FWIW I support this view, with the added observation from
      James Cloos that "3 0 0" can also match raw public keys via
      the enclosed SPKI value].

    * What document should define this representation, and amend
      the restrictive language in 6698 Section 1.3:
	
	   This document only applies to PKIX [RFC5280] certificates, not
	   certificates of other formats.

      and extend the definition of usage 3 or some new [ideally not]
      usage to handle raw public keys.

Are these the right questions?

[ Turf issues aside, there seems to be enough subtle detail in getting
this right that it seems to me that a new DANE WG document, quite possibly
whatever we call the current "ops" draft by the time November rolls around,
is the right place to define this mapping. ]

-- 
	Viktor.