Re: [Secdispatch] Requesting agenda time for draft-halen-fed-tls-auth

[Eric Rescorla <[e-mail]>]

Thanks for your response. I would advise putting these points in the
specification.

-Ekr


On Fri, Jul 8, 2022 at 8:01 AM Stefan Halen <
[e-mail]> wrote:

>  > But as I understand this design, you in fact have a PKI, it's
>  > just that it's carried in a single JWS-signed metadata object
>  > rather than in X.509 certificates. This seems less flexible,
>  > so it's not clear to me what the advantage of this design
>  > is.
>
> The metadata is also used for discovery. The client normally select a
> server based on metadata claims (e.g., organization, tags). The client
> connects to the server's base_uri, also found in metadata.
>
> The federation operator must keep track of the members and which
> combinations of tags and peer type each member may publish.
>
> To enable self-signed certificates, there is the possibility of
> publishing issuers.
>
> Issuers are for reverse proxys that do not support optional_no_ca. Pin
> validation is performed by the application
>
>  > This needs considerably more detail about how it is used
>  > in practice. Specifically, it's not clear to me what
>  > the reference identity is that I am supposed to compare
>  > the pins to. I.e., if I think I am connecting to a given
>  > domain name, which is the common practice, how do I look
>  > that up in the metadata?
>
> In this federation, clients will only connect to services with which
> they have a business relationship (i.e, discovery by organization and
> tags).
>
>
> Thank you for the input!
>
> Regards
> Stefan
>