Re: [radext] Stephen Farrell's Yes on draft-ietf-radext-dynamic-discovery-13: (with COMMENT)

[Stefan Winter <[e-mail]>]

Hello,

thanks for the compliment!

> I have to say radext drafts are frequently very high
> quality and this is no exception. Thanks.
> 
> - 2.1.1.3 - typo: s/PKS/PSK/

This is fixed in my working copy and will be in -14.

> - 2.2, just wondering (and not suggesting you change)
> but did you consider that using san.dNSName with an
> accompanying policy OID could allow you to use
> current CA s/w without confusing the semantics (and
> without requiring the new otherName)?

It's a bit tricky: a RADIUS server typically has a DNS hostname (and
that may want to/need to be placed in the cert for arbitrary reasons),
and serves NAI realms on a RADIUS level - but the two are not
necessarily identical.
So there would be several sAN:DNS entries in the cert, one or more
pertaining to the hostname, one or more pertaining to the NAI realms served.
I guess a CA policy could "fix" that ambiguity by hard-wiring that the
first sAN:DNS in its certs would semantically mean "the host" and any
following ones would be "NAI realms served" but it doesn't strike me as
a terribly clean solution.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: [phone]
Fax: [phone]

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66