Re: [keyassure] publishing the public key

[Paul Wouters <[e-mail]>]

On Sun, 20 Feb 2011, Paul Hoffman wrote:

> On 2/20/11 2:51 PM, Paul Wouters wrote:
>> The whole point is we do not want to identify a cert. We want to
>> identify a key.
>
> That's not the case currently, at least for many of us.

I'm unclear if you mean "currently with CAs" or "currently within the DANE draft".

> Given that the only 
> thing that can be used in TLS to identify the server is a certificate, most 
> of us want to identify that certificate (or a trust anchor that the 
> certificate chains to).

You confuse me here too. We have an RRlabel, which replaces the validated CN=
and the key (blob or hash) that replaces the public key part of the cert.

> As one of the document editors, if the WG says that it also wants to have 
> keys as targets, I will also need (a) a rationale for why this is wanted and 
> (b) text explaining how to make a certificate association between the key and 
> the certificate that comes from the TLS server. I have asked a few times for 
> these, with no luck so far. I don't know that the WG can actually decide to 
> add bare keys without knowing how they will be used.

I will get that to you before Prague.

Paul