Re: [Dots] Alexey Melnikov's Discuss on draft-ietf-dots-signal-channel-31: (with DISCUSS and COMMENT)

["Alexey Melnikov" <[e-mail]>]

Hi,

On Thu, May 2, 2019, at 1:47 PM, Konda, Tirumaleswar Reddy wrote:

> > > 7) In 7.1:
> > >
> > >    When a DOTS client is configured with a domain name of the DOTS
> > >    server, and connects to its configured DOTS server, the server may
> > >    present it with a PKIX certificate.  In order to ensure proper
> > >    authentication, a DOTS client MUST verify the entire certification
> > >    path per [RFC5280].  The DOTS client additionally uses [RFC6125]
> > >    validation techniques to compare the domain name with the certificate
> > >    provided.
> > >
> > > I am glad that you are referencing RFC 6125 here, but the description is not
> > > complete. Do you allow for wildcards in certificate subjectAltNames? Do you
> > > support CN-ID, DNS-ID, SRV-ID, URI-ID? I think you only want to support 
> > > DNS-ID
> > > and possibly SRV-ID and CN-ID. This needs to be explicitly stated in the
> > > document.
> > >
> > 
> > [Med] Fair enough. Will consider updating the text.
> 
> We will add the following text to address the above comment:
> 
>       Certification authorities that issue DOTS server certificates
>       SHOULD support the DNS-ID and SRV-ID identifier types. 
>       DOTS server SHOULD prefer the use of DNS-ID  and SRV-ID 
>       over CN-ID identifier types in certificate requests 
>       (as described in Section 2.3 from [RFC6125]) and the
>       wildcard character '*' SHOULD NOT be included in the presented
>       identifier.

This still doesn't say whether URI-ID is allowed. May I suggest that you add the following sentence at the beginning of this paragraph:

       DOTS protocol doesn't use URI-IDs for server identity verification.

Also, I would like to understand how SRV-IDs are to be used by DOTS. The document doesn't register any new service name for DOTS protcol, so it is not clear how SRV-IDs can be used.

Thank you,
Alexey