Re: [keyassure] I-D Action:draft-ietf-dane-protocol-05.txt

[Stephen Kent <[e-mail]>]

At 6:27 PM +0100 2/24/11, Martin Rex wrote:
>...
>  > In the IETF, PKIX profiles X.509 for use with IETF security protocols,
>>  so it probably makes sense to stick with the PKIX label here. This is
>>  certainly true for EE certs. For a self-signed cert used to convey
>>  trust anchor material, we may need some additional/different text.
>
>
>But this would imply that EE certs will have to be issued by commercial CAs.

no. anyone can be a CA.

>I thought that one of the purposes of DANE was to allow server admins
>to create their own certificate and distribute it through DNS(SEC) TLSA
>records.

see comment above.

>Maybe we should distinguish more types:
>
>    1 -- An end-entity X.509 certificate in ASN.1 DER encoding
>
>    2 -- A certification authority's X.509 certificate in ASN.1 DER encoding
>
>    3 -- An end-entity PKIX certificate from the TLS X.509 PKI
>
>    4 -- A certification authority's PKIX certificate from the TLS X.509 PKI
>
>For (1), the client would match the server certificate with the TLSA
>record and be done with it, for (3), besides matching the server certificate
>with the TLSA record, the client is expected to perform a regular
>certificate path validation.

as others have pointed out, X.509 vs. PKIX is not generally a 
meaningful distinction in this context, so the wording above is 
confusing, at best.

I plan to work with Paul to generate appropriate text, to match
PKIX standards, while preserving the intent of the DANE docs.

Steve