Re: [Danish] Proposed WG Charter

[Michael Richardson <[e-mail]>]

Viktor Dukhovni <[e-mail]> wrote:
    >> The now closed DANE working group (WG) produced a mechanism that
    >> supported authentication of TLS server identities via a DNSSEC-secured
    >> infrastructure.  Operational experience with DANE has validated the
    >> utility of a DNS-enabled mechanism for discovering authenticated keys,
    >> but has also shown that reliance on DNSSEC is a significant barrier to
    >> adoption.

    > The term "discovering authentication keys" is not defined here.  It is
    > not clear that avoiding DNSSEC will make things simpler.  Which is the
    > more important barrier here, zone signing, or access to validating
    > resolvers?

I think that those are good questions, but it may be too much for a charter.
I don't think charters should worry about definitions :-)

We had a lot of nodding at the BOF.
Looking at the conflicts and having watched the conflicting WG sessions (and
who making noise there and not at our BOF) I'm sure that this at least party
due to some people being elsewhere :-)

    >> A Certificate Authority (CA) is one example of a PKI which can be used for

    > FWIW, the established term of art is "Certification Authority".

:-)
What a great discussion that was a year ago, eh?

    >> to enable the messaging security use case, in a manner which will work
    >> securely in the absence of DNSSEC.

    > Why is avoiding DNSSEC simpler than making it more compelling to deploy?

I see this as a sticking point.
Those who like DNSSEC will dislike working around it.
Those who think DNSSEC will never sail will use this to sink it.

    >> -Scope of work
    >> DANISH will specify the TLS session and message security use cases and an
    >> architecture describing the primary components and interaction patterns.

    > I think the charter should go some way to clarifying the intended use
    > cases.

I think that's actually more than a charter should say.
The charter needs to specific enough to tell people if they are interested in
the problem, and motivate them enough to read a use case document.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide