Re: [OPSAWG] Fwd: New Version Notification for draft-ietf-opsawg-mud-21.txt

[Eliot Lear <[e-mail]>]

Hi EKR,


On 18.05.18 19:57, Eric Rescorla wrote:
> Eliot, > > The certificate part seems basically right (I think you should
require specific KeyUsage bits).
It's in there:
> It is expected that the Key Usage extension would contain "Digital
> Signature" and that the extended key usage would include either "code
> signing" or "email protection".

This leaves a little a little flexibility.  I think this is sufficient,
and compatible with existing CAs.


> > Maybe I missed it, but I didn't see anything about the level of trust
you should have in cases where you can't reliably tie the endpoint's
transmissions to its certificate.
It's there but could be clearer:

OLD:
> A
> MUD manager MUST cease processing of that file it cannot validate the
> chain of trust to a known trust anchor until an administrator has
> given approval.

NEW:

> A
> MUD manager MUST cease processing of that file it cannot validate the
> chain of trust to a known trust anchor or the MUDsigner until an
> administrator has
> given approval.

That is- throw an exception and let the admin sort it out.

Eliot