Re: [Secdispatch] Requesting agenda time for draft-rsalz-use-san

+1 for draft-rsalz-use-san
+1 for Ben's list of things to do for updating 6125

RFC 6125 is important. I think draft-rsalz-use-san and Ben's list of things to do for updating 6125 should be part of RFC6125bis done in a WG.

John

-----Original Message-----
From: Secdispatch <secdispatch-bounces@ietf.org> on behalf of Benjamin Kaduk <kaduk@mit.edu>
Date: Wednesday, 3 March 2021 at 06:55
To: Martin Thomson <mt@lowentropy.net>
Cc: "secdispatch@ietf.org" <secdispatch@ietf.org>
Subject: Re: [Secdispatch] Requesting agenda time for draft-rsalz-use-san

On Wed, Mar 03, 2021 at 03:56:25PM +1100, Martin Thomson wrote:
> What Rich is doing here is good.  ~~SAN~~CN is dead and we should ensure that our documentation reflects that.  (Even at the time of 6125 it was a holdover from a previous era.)
> 
> Is now the time that we get to talk about other updates to RFC 6125?  Because there is no IP-ID reference identity in RFC 6125 and HTTP had to define one just to document what happens in practice: https://protect2.fireeye.com/v1/url?k=6c98cf38-3303f613-6c988fa3-866038973a15-d092f6bd04e72169&q=1&e=aa803440-e857-4dee-a5fe-3c4ab8ff3e81&u=https%3A%2F%2Fhttpwg.org%2Fhttp-core%2Fdraft-ietf-httpbis-semantics-latest.html%23https.ip-id

I do have a longstanding item in my list of things to do for updating 6125
in this manner.  (Note that
https://tools.ietf.org/html/draft-ietf-dtn-tcpclv4-25#section-4.4.1 has
also had to define an IPADDR-ID.)

I *also* have a longstanding item in my list for doing something analogous
to 6125 but for client authentication.  That, however, is a much more
open-ended question that should be a separate effort.

> I don't want to get in the way of making actual progress here, but knowing the difficulties with getting 6125 done, it might be safer to do this work in a working group.  I have no opinion regarding whether it is a new one or UTA.

I am hopeful that the UTA chairs can provide some thoughts here.

-Ben

> On Fri, Feb 5, 2021, at 02:43, Salz, Rich wrote:
> > I would like to present https://datatracker.ietf.org/doc/draft-rsalz-use-san/
> > 
> > This updates RFC 6125 to remove commonName as a way to identify the 
> > server; just use subjectAltName.  It also limits where the "*" can go 
> > in wildcard certificates. This is a simplification of widely 
> > implemented existing practice. It may even be de facto what's mostly 
> > done. Perhaps the wildcard limitation is controversial and I'd be 
> > willing to remove it.
> > 
> > 6125 was AD-sponsored. I think this could also be, or perhaps it could 
> > go to UTA. I would not present any slides, and think 10-15 minutes 
> > would be enough time.
> >  
> > 
> > _______________________________________________
> > Secdispatch mailing list
> > Secdispatch@ietf.org
> > https://www.ietf.org/mailman/listinfo/secdispatch
> >
> 
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch

_______________________________________________
Secdispatch mailing list
Secdispatch@ietf.org
https://www.ietf.org/mailman/listinfo/secdispatch