Re: I-D ACTION:draft-ietf-pkix-prqp-00.txt

[Massimiliano Pala <[e-mail]>]

Hi Tom,

I do not understand how this actually applies. The dnsName is just one type
of GeneralNames (if I do remember correctly), therefore considerations about
AIA and SIA are not actually affected.

I do, anyway, understand your point: can we add a reference in the certificate
so that we know which DNS domain we shall query for DNS SRV records related
to PKI resources ?

I considered this, and I do really think it is a viable solution. I do have
some personal concerns about using DNS for this purpose. I think DNS SRV
records work great for services provided within an organization (eg., within
a university .example.edu - I am not aware of anyone who is actually using
DNS SRV records on public DNSs) but having PKI managers to modify the DNS
servers can be painful in certain environments. Besides this, having a
separate service allows us to provide signed messages (both client and server)
with NONCE. Moreover, a service that is decoupled from DNS can be easier to
maintain, especially in a trusted-responder multi-CAs mode.

But if other people share your opinion, please let me know, so we can update
the document properly.

Later,
Max


Tom Gindin wrote:
>         Section 2.1 of this draft gives an overview of existing solutions 
> and their limitations.  It does not appear that any consideration was 
> given to adding a new AccessDescription (to the SIA and/or AIA extensions) 
> for SRV record access.  The argument against the use of SRV records given 
> in 2.1.2 is that there is not generally a fixed mapping between the 
> certificate and a DNS space, which does not apply to a DNSName within an 
> AIA or SIA extension.