Re: [secdir] secdir review of draft-ietf-csi-proxy-send-04

Jeffrey Hutzelman <jhutz@cmu.edu> Tue, 14 September 2010 20:33 UTC

Return-Path: <jhutz@cmu.edu>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E4F333A6A8B; Tue, 14 Sep 2010 13:33:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.556
X-Spam-Level:
X-Spam-Status: No, score=-106.556 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7PslrS7oDGMu; Tue, 14 Sep 2010 13:33:10 -0700 (PDT)
Received: from smtp03.srv.cs.cmu.edu (SMTP03.SRV.CS.CMU.EDU [128.2.217.198]) by core3.amsl.com (Postfix) with ESMTP id 21E5C3A6AFC; Tue, 14 Sep 2010 13:32:53 -0700 (PDT)
Received: from MINBAR.FAC.CS.CMU.EDU (MINBAR.FAC.CS.CMU.EDU [128.2.216.42]) (authenticated bits=0) by smtp03.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id o8EKWlM7006867 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 14 Sep 2010 16:32:47 -0400 (EDT)
Date: Tue, 14 Sep 2010 16:32:47 -0400
From: Jeffrey Hutzelman <jhutz@cmu.edu>
To: Sean Turner <turners@ieca.com>, marcelo bagnulo braun <marcelo@it.uc3m.es>
Message-ID: <8EA3785E28E67B2A2DC45EC3@minbar.fac.cs.cmu.edu>
In-Reply-To: <29443_1284477154_o8EFCWBY026030_4C8F90D4.3040301@ieca.com>
References: <E7FA9617215B4AE08B038FC422C42568@bombo> <8984FD9D-2516-437A-AEF3-8E0F5DDAD6EB@cisco.com> <E78B1895-1C34-4C74-96E2-21A6D267FC6C@gmail.com> <241F9803-ED2F-48B2-B192-2AC02B280433@cisco.com> <4C8E41F6.906@it.uc3m.es> <29443_1284477154_o8EFCWBY026030_4C8F90D4.3040301@ieca.com>
X-Mailer: Mulberry/4.0.8 (Linux/x86)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-Scanned-By: mimedefang-cmuscs on 128.2.217.198
Cc: Roque Gagliano <rogaglia@cisco.com>, draft-ietf-csi-send-cert@tools.ietf.org, secdir@ietf.org, Sandra Murphy <Sandra.Murphy@sparta.com>, García <alberto@it.uc3m.es>, draft-ietf-csi-proxy-send.all@tools.ietf.org, Alberto@core3.amsl.com, IESG IESG <iesg@ietf.org>, csi-chairs@tools.ietf.org, Ralph Droms <rdroms.ietf@gmail.com>
Subject: Re: [secdir] secdir review of draft-ietf-csi-proxy-send-04
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Sep 2010 20:33:13 -0000

--On Tuesday, September 14, 2010 11:12:20 AM -0400 Sean Turner 
<turners@ieca.com> wrote:

>> The new EKU is the proposed way to deal with one comment from Sandy's
>> review of the proxy send document. It seems we could live without, but
>> it would be a somehow inferior solution. I would suggest that unless
>> getting a new EKU is a lot of work, we go ahead with that.
>
> Getting an EKU is pretty easy.  Ask Russ Housley <housley@vigilsec.com>
> (cced) for one.  He controls assigning the OID out of the PKIX arc.
> Obvioulsy, you'll need to add some text in the document to explain its
> use.

In fact, it can be even easier than that.  The whole point of using OIDs 
for this is that an EKU can be _any_ OID, not just one out of that arc.  So 
if you have your own arc (or a PEN), you can assign your own OID.

-- Jeff