Re: [Danish] Charter Text and the Problem Statement

[Viktor Dukhovni <[e-mail]>]

> On 21 Jun 2021, at 1:10 am, Hannes Tschofenig <[e-mail]> wrote:
> 
> In the past we used different keys for different purposes. A manufacturer provided key was used for a relatively small number of tasks (typically for obtaining operational keys). For use with application services we used a different key. We used yet another key for firmware updates and again another for attestation.
> 
> What has changed?

FWIW, nothing about DANE suggests using a single key for multiple
purposes.  On the contrary for server identity, DANE has a much
better story than WebPKI, because the server is authenticated by
port and name, not just name, which makes it easier (with DANE-EE(3))
to field a separate key for each service endpoint.

If we're extending DANE to client identities, we can again create
application-specific names, with a separate key for each application:


    _app1.device12345.example.com. IN TLSA 3 1 1 ...
    _app2.device12345.example.com. IN TLSA 3 1 1 ...
    ...

Just register appropriate special-use labels for each distinct
application-specific key, perhaps even multiple keys for a single
application where it makes sense to have key separation.

If the protocol in question is unrelated to TLS, one should consider
using a new record type, other than TLSA.  There may be additional
data beyond the key value or digest that would be beneficial to
return.

-- 
-- 
	Viktor.