Re: [keyassure] I-D Action:draft-ietf-dane-protocol-05.txt

[Ben Laurie <[e-mail]>]

On 23 February 2011 07:06, Jakob Schlyter <[e-mail]> wrote:
> On 23 feb 2011, at 08.00, [e-mail] wrote:
>
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the DNS-based Authentication of Named Entities Working Group of the IETF.
>>
>>
>>       Title           : Using Secure DNS to Associate Certificates with Domain Names For TLS
>>       Author(s)       : P. Hoffman, J. Schlyter
>>       Filename        : draft-ietf-dane-protocol-05.txt
>>       Pages           : 12
>>       Date            : 2011-02-22
>
> We've made some updates and clarifications based on input from Scott Schmit and others, and also addressed issue #20.
> Diff and full history can be found at http://tools.ietf.org/wg/dane/draft-ietf-dane-protocol/.

In this version you define cert types like this:

         1 -- An end-entity certificate in DER encoding

         2 -- A certification authority's certificate in DER encoding

and later say:

   Certificate types 1 and 2 explicitly only apply to PKIX-formatted
   certificates.  If TLS allows other formats later, or if extensions to
   this protocol are made that accept other formats for certificates,
   those certificates will need certificate types.

Since DER encoding can be applied to anything specified in ASN.1,
perhaps this explicitness should be in the definitions, e.g.:

         1 -- A PKIX end-entity certificate in DER encoding

         2 -- A PKIX certification authority's certificate in DER encoding