Re: [Dots] Eric Rescorla's Discuss on draft-ietf-dots-requirements-18: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

On Fri, Feb 22, 2019 at 08:44:58AM -0800, Eric Rescorla wrote:
> On Fri, Feb 22, 2019 at 8:06 AM Konda, Tirumaleswar Reddy <
> [e-mail]> wrote:
> 
> > *From:* Eric Rescorla <[e-mail]>
> > *Sent:* Friday, February 22, 2019 7:11 PM
> > *To:* Konda, Tirumaleswar Reddy <[e-mail]>
> > *Cc:* The IESG <[e-mail]>; [e-mail];
> > [e-mail]; [e-mail];
> > [e-mail]
> > *Subject:* Re: Eric Rescorla's Discuss on
> > draft-ietf-dots-requirements-18: (with DISCUSS and COMMENT)
> >
> > On Fri, Feb 22, 2019 at 3:41 AM Konda, Tirumaleswar Reddy <
> > [e-mail]> wrote:
> >
> > > -----Original Message-----
> > > From: Eric Rescorla <[e-mail]>
> > > Sent: Thursday, February 21, 2019 8:33 PM
> > > To: The IESG <[e-mail]>
> > > Cc: [e-mail]; [e-mail]; Liang Xia
> > > <[e-mail]>; [e-mail];
> > > [e-mail]
> > > Subject: Eric Rescorla's Discuss on draft-ietf-dots-requirements-18:
> > (with
> > > DISCUSS and COMMENT)
> > >
> > >
> > > DETAIL
> > > S 2.2.
> > > >         free to attempt abbreviated security negotiation methods
> > supported
> > > >         by the protocol, such as DTLS session resumption, but MUST be
> > > >         prepared to negotiate new security state with the redirection
> > > >         target DOTS server.  The authentication domain of the
> > redirection
> > > >         target DOTS server MUST be the same as the authentication
> > domain
> > > >         of the redirecting DOTS server.
> > >
> > > what is an "authentication domain"?
> >
> > We are trying to say both the redirecting and redirected target DOTS
> > server belong to the same administrative domain.
> >
> > Modified the last line as follows:
> > The redirection DOTS server and redirecting DOTS server MUST belong to the
> > same administrative domain.
> >
> >
> >
> > How do I interpret this as the redirected party? Does it have to be the
> > same identity in the certificate? Something else?
> >
> >
> >
> > The redirected (or alternate) DOTS server’s FQDN will be conveyed by the
> > redirecting DOTS server, and DOTS client uses the same explicit trust store
> > to validate
> >
> > both the servers certificates.
> >
> 
> OK, so the client has no way of knowing if these are actually the same
> admin domain, it's just an operational requirement?

(D)TLS mutual auth is used, so there is some information available as a
proxy for "same admin domain", like "certificate issued by same private CA
hierarchy" or similar.

-Benjamin