Re: [Sidrops] Benjamin Kaduk's No Objection on draft-ietf-sidrops-https-tal-07: (with COMMENT)

[Tim Bruijnzeels <[e-mail]>]

Hi Ben,

> On 3 May 2019, at 03:03, Benjamin Kaduk <[e-mail]> wrote:
> 
>> Note that, although a Man in the Middle (MITM) cannot produce a CA
>> certificate that would be considered valid according to the process
>> described in Section 3, this attack can prevent that the Relying Party
>> learns about an updated CA certificate.
> 
> I think (but am only about 80% sure) that we want "updated or removed"
> here.  So add it if it makes sense to you, and if not, don't worry about
> it.

I don't think "removed" applies here. If the TA intended to no longer publish a certificate for a key, that would imply that they are trying to do a key roll. Key rolls are not covered by this document.

There is another document that talks about TA key rolls - using a signed object, with TAL like content:
https://tools.ietf.org/html/draft-ietf-sidrops-signed-tal-02

This draft is currently expired, but as co-author I plan to do an update at least in time for IETF105. I was postponing the update because I had hoped to do some proof of concept implementation first.


Thanks
Tim





> 
> Thanks,
> 
> Ben