Re: [sidr] wglc draft-ietf-sidr-policy-qualifiers-00

[John Curran <[e-mail]>]

On Jul 14, 2013, at 2:41 AM, Melinda Shore <[e-mail]> wrote:

> On 7/13/13 9:20 PM, John Curran wrote:
>> If that's the case for you, then don't use it on your certs.  However, your 
>> requirements don't necessarily encompass all RPKI users, and overall system
>> robustness is improved by having the policy qualifier language in RFC6487 
>> more clearly line up with RFC5280 since they are going to be in use by others.
> 
> I think I'm coming down in largely the same place Randy is (with some
> fuzz around the edges).  I'm not sure I understand the consequences of
> not publishing this.


There are really two issues here:

- RFC 6487 does not specifically allow or disallow a policy qualifiers;
  one may read the preface in section 4 as implying it is disallowed, but 
  the document is much more explicit regarding allowed/disallowed fields 
  in other extensions.  As RFC 5280 specifically defines the certificate 
  policies extension as containing a sequence of policy information terms 
  (each of which has object identifier (OID) and optional qualifiers), 
  inclusion of "exactly one policy" doesn't necessarily mean with or 
  without optional qualifiers.  A validator shouldn't have to guess at
  what it allowed in the specification, so RFC 6487 should be clarified
  (one way or the other) on the matter of policy qualifiers.

- If we're going to clarify RFC 6487, then it can be disallowing the 
  policy qualifiers already defined in RFC 5280 or by allowing them.
  Some of the users of RPKI specifications (ARIN) would like to allow
  them (in particular, the CPS pointer policy qualifier) and hence
  the reason for draft-ietf-sidr-policy-qualifiers-00.  You may not 
  see a need to include policy qualifier on the certificates that you
  issue, but providing a reference to CPS in the certificate may be 
  useful for both CA operators and certificate users on occasion.

Thanks,
/John