Re: [keyassure] publishing the public key

[Paul Hoffman <[e-mail]>]

On 2/20/11 3:16 PM, Paul Wouters wrote:
> On Sun, 20 Feb 2011, Paul Hoffman wrote:
>
>> On 2/20/11 2:51 PM, Paul Wouters wrote:
>>> The whole point is we do not want to identify a cert. We want to
>>> identify a key.
>>
>> That's not the case currently, at least for many of us.
>
> I'm unclear if you mean "currently with CAs" or "currently within the
> DANE draft".

Neither: I mean "currently with the WG, as far as this discussion has gone".

>> Given that the only thing that can be used in TLS to identify the
>> server is a certificate, most of us want to identify that certificate
>> (or a trust anchor that the certificate chains to).
>
> You confuse me here too. We have an RRlabel, which replaces the
> validated CN=
> and the key (blob or hash) that replaces the public key part of the cert.

Quite true. But we don't have any text that says that.

>> As one of the document editors, if the WG says that it also wants to
>> have keys as targets, I will also need (a) a rationale for why this is
>> wanted and (b) text explaining how to make a certificate association
>> between the key and the certificate that comes from the TLS server. I
>> have asked a few times for these, with no luck so far. I don't know
>> that the WG can actually decide to add bare keys without knowing how
>> they will be used.
>
> I will get that to you before Prague.

Ah! So we will. If someone comes up with text before then, great, but if 
not, can we put this discussion on hold until we have something concrete 
to discuss?