Re: [Gen-art] Gen-ART last call review of draft-ietf-mile-rfc6046-bis-05

[Brian Trammell <[e-mail]>]

Hi, Alexey,

one more round (hopefully) :) ...

On Jan 23, 2012, at 2:19 PM, Alexey Melnikov wrote:

>> 
>> Okay; how about the following (including Alexey's comments from the previous review, and pointing more specifically to 6125)
>> 
>>     <t>RID systems MUST verify the identity of their peers against that stored
>>     in the certificate presented, as in section 6 of<xref target="rfc6125"/>.
>>     As RID systems are identified not by URI and RID does not use DNS SRV
>>     records, they are identified solely by their DNS Domain Names; see Section
>>     6.4 of<xref target="rfc6125"/>.
> (I think you are saying that [using RFC 6125 terminology] DNS-IDs are supported, but SRV-IDs or URI-IDs aren't.)

I can say that directly then.

> This is better, but I think you need to say a bit more. Are CN-IDs allowed? Are wildcards allowed?

Here, I'm a little unclear on the implications this has for implementation: is it reasonable to assume that all implementations that support TLS 1.1 should not require CN-IDs for backward compatibility?

> Another example of the document that describes
> http://tools.ietf.org/html/draft-melnikov-email-tls-certs-00

Thanks for the example. Here's what I've come up with for now...

    <t>RID systems MUST verify the identity of their peers against that stored
    in the certificate presented. All RID systems MUST be identified by a
    certificate containing a <xref target="RFC5280">DNS-ID identifier</xref>
    as in section 6.4 of <xref target="RFC6125"/>. Certificates identifying
    RID systems MAY additionally contain a CN-ID identifier, to allow backward
    compatibility with older PKI implementations. Wildcards MUST NOT appear in
    the DNS-ID or CN-ID of a certificate identifying a RID system. Additional
    general information on the use of PKI with RID systems is detailed in
    Section 9.3 of <xref target="I-D.ietf-mile-rfc6045-bis"/>.</t>

(The text about CN-IDs would be removed if the assumption that TLS 1.1 implies no need for CN-ID, as above)

Thanks,

Brian