Re: [Sidrops] Barry Leiba's No Objection on draft-ietf-sidrops-https-tal-07: (with COMMENT)

[Tim Bruijnzeels <[e-mail]>]

Dear Barry,

> On 8 Apr 2019, at 06:49, Barry Leiba via Datatracker <[e-mail]> wrote:
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> I realize that this document inherits the text in Section 3 from RFC 6490, but
> can you tell me why there are SHOULDs and not MUSTs?  Why would one NOT do it
> the way Section 3 specifies?

The first half of section 3 specifies how an RP uses the TAL to download and validate a TA certificate. In my opinion the SHOULD in the first sentence could be a MUST.

The remainder of the section deals with strategies regarding downloading fresh copies, and choosing which of the (equivalent) URIs to use. In practice I believe that most if not all RP implementations fetch TA certificates on each validation run and the expiration time of the certificate is generally ignored - this does not conflict with the SHOULDs because generally these validation runs happen with a frequency of 10 mins, or hours at must - so it's much sooner. Furthermore some RPs choose to only try one URI to keep their code complexity low.

In short I don't remember clearly from the time that RFC7730 was discussed, but I don't think that there was consensus in the WG for a more formal and MUST-y specification for RP use. So, I think the SHOULDs reflect that.


> Then I’ll ask the same question for the new https text in Section 4, especially
> about TLS certificate and host name validation.

Yes, and good point. Pete Resnick raised a similar point and I replied to him yesterday. Are your okay with discussing this point in that thread?

Thank you

Tim