Re: [keyassure] WebID at W3C and keyassure

[Paul Hoffman <[e-mail]>]

On 2/10/11 2:41 PM, Henry Story wrote:
> Keyassure will probably use the DNS-ID typed subject alternative name
> (SAN) or Issuer Alternative Name (IAN) in a *server* X509 certifactes
> to identify the server as suggested is good practice by
> http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-14#section-2.3

In
>
your earlier message, you said:

> (I have not seen a draft spec yet, and am going from the group
> description).

Please do read the draft. What you say here, which predicates the rest
of your message about similarities with the WebID work, is not at all
correct.

This is not to say that what WebID is doing can't work with the DANE 
effort, just that we are doing completely different things. DANE is 
about getting a temporary trust anchor for a particular 
port/transport/domainname triple for a server, whereas WebID is about 
identifying clients through an HTTPS lookup. There has been discussion 
of using DANE to get a temporary trust anchor for S/MIME clients, and 
that might be extended to doing so for TLS clients, but it would be done 
using the DNS protocol.