[POSH] Fwd: I-D Action: draft-miller-posh-03.txt

FYI; a minor update to note it's primary applicability to XMPP, but can still be used by other protocols.

- m&m

Matt Miller < mamille2@cisco.com >
Cisco Systems, Inc.

Begin forwarded message:

> From: <internet-drafts@ietf.org>
> Subject: I-D Action: draft-miller-posh-03.txt
> Date: November 12, 2013 at 3:30:59 PM MST
> To: <i-d-announce@ietf.org>
> Reply-To: <internet-drafts@ietf.org>
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
> 	Title           : PKIX over Secure HTTP (POSH)
> 	Author(s)       : Matthew Miller
>                          Peter Saint-Andre
> 	Filename        : draft-miller-posh-03.txt
> 	Pages           : 15
> 	Date            : 2013-11-12
> 
> Abstract:
>   Experience has shown that it is extremely difficult to deploy proper
>   PKIX certificates for TLS in multi-tenanted environments, since
>   certification authorities will not issue certificates for hosted
>   domains to hosting services, hosted domains do not want hosting
>   services to hold their private keys, and hosting services wish to
>   avoid liability for holding those keys.  As a result, domains hosted
>   in multi-tenanted environments often deploy non-HTTP applications
>   such as email and instant messaging using certificates that identify
>   the hosting service, not the hosted domain.  Such deployments force
>   end users and peer services to accept a certificate with an improper
>   identifier, resulting in obvious security implications.  This
>   document defines two methods that make it easier to deploy
>   certificates for proper server identity checking in non-HTTP
>   application protocols.  The first method enables the TLS client
>   associated with a user agent or peer application server to obtain the
>   end-entity certificate of a hosted domain over secure HTTP as an
>   alternative to standard PKIX techniques.  The second method enables a
>   hosted domain to securely delegate a non-HTTP application to a
>   hosting service using redirects provided by HTTPS itself or by a
>   pointer in a file served over HTTPS at the hosted domain.  While this
>   approach is developed for use in the Extensible Messaging and
>   Presence Protocol (XMPP) as a Domain Name Association prooftype, it
>   can be applied to any non-HTTP application protocol.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-miller-posh
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-miller-posh-03
> 
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-miller-posh-03
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> I-D-Announce@ietf.org
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

[POSH] Fwd: I-D Action: draft-miller-posh-03.txt

Attachment: signature.asc