Re: [Secdispatch] Requesting agenda time for draft-rsalz-use-san

On Wed, Mar 03, 2021 at 03:56:25PM +1100, Martin Thomson wrote:
> What Rich is doing here is good.  ~~SAN~~CN is dead and we should ensure that our documentation reflects that.  (Even at the time of 6125 it was a holdover from a previous era.)
> 
> Is now the time that we get to talk about other updates to RFC 6125?  Because there is no IP-ID reference identity in RFC 6125 and HTTP had to define one just to document what happens in practice: https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#https.ip-id

I do have a longstanding item in my list of things to do for updating 6125
in this manner.  (Note that
https://tools.ietf.org/html/draft-ietf-dtn-tcpclv4-25#section-4.4.1 has
also had to define an IPADDR-ID.)

I *also* have a longstanding item in my list for doing something analogous
to 6125 but for client authentication.  That, however, is a much more
open-ended question that should be a separate effort.

> I don't want to get in the way of making actual progress here, but knowing the difficulties with getting 6125 done, it might be safer to do this work in a working group.  I have no opinion regarding whether it is a new one or UTA.

I am hopeful that the UTA chairs can provide some thoughts here.

-Ben

> On Fri, Feb 5, 2021, at 02:43, Salz, Rich wrote:
> > I would like to present https://datatracker.ietf.org/doc/draft-rsalz-use-san/
> > 
> > This updates RFC 6125 to remove commonName as a way to identify the 
> > server; just use subjectAltName.  It also limits where the "*" can go 
> > in wildcard certificates. This is a simplification of widely 
> > implemented existing practice. It may even be de facto what's mostly 
> > done. Perhaps the wildcard limitation is controversial and I'd be 
> > willing to remove it.
> > 
> > 6125 was AD-sponsored. I think this could also be, or perhaps it could 
> > go to UTA. I would not present any slides, and think 10-15 minutes 
> > would be enough time.
> >  
> > 
> > _______________________________________________
> > Secdispatch mailing list
> > Secdispatch@ietf.org
> > https://www.ietf.org/mailman/listinfo/secdispatch
> >
> 
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch