Re: [pkix] TLS server authentication schemes...

[Phillip Hallam-Baker <[e-mail]>]

No, that really is the case you are making.

It may be rather inconvenient for you to see your points laid out in that
fashion but that is exactly what you have been arguing.


There are three issues here

1) Are the parts of CAA that you are objecting to useful?

I don't think anyone is objecting to the fact that they are.


2) Are they within PKIX charter scope?

They are very clearly within the IETF PKIX charter. They are very clearly
similar to schemes such as OCSP and SCVP that the group has considered
previously.


3) Are they in DANE charter scope?

That is rather less clear because the DANE charter does not actually
explicitly state that it is going to propose the restriction semantics you
describe in your draft.


I find this argument over process to be rather tiresome and irrelevant. I
suggest that if someone has a problem with doing CAA in PKIX that they
propose an applicability statement to the IESG and let them handle it.

I also think that you would be much better advised to remove the restriction
semantics from your own draft until such time as you have demonstrated that
you have an effective and reliable mechanism for key distribution first.



On Sat, Jun 11, 2011 at 11:10 AM, Paul Hoffman <[e-mail]>wrote:

> On Jun 11, 2011, at 6:55 AM, Phillip Hallam-Baker wrote:
>
> > The argument you and Paul seem to be advancing is:
>
> False. I am advancing the arguments that I give in my messages, not the
> ones you attribute to me. Again: please state what you believe, but maybe
> consider not stating what others believe.
>
> --Paul Hoffman
>
>


-- 
Website: http://hallambaker.com/