Re: [lamps] Proposed recharter text

[Ryan Sleevi <[e-mail]>]

On Thu, Feb 11, 2021 at 11:09 AM Salz, Rich <[e-mail]> wrote:

>
>    - Are there even two interoperable implementations of 5280?
>
>
>
> No, I think things will need to be stripped out.
>

I agree, but I also worry it will open re-litigation of things that are
de-facto, but not standardized, despite efforts to the contrary.

As a concrete example, the handling of extendedKeyUsage within
intermediates is one of those issues that comes up every few years, but to
not much progress. This debate goes back (as far as I can tell) to even the
RFC 2459 work, where rough consensus and running code (at the time, and at
the present) implemented something different. This is something that
affects (2) with respect to the process of determining validity.

As an example of (3), consider the use of StringPrep with regards to DN
handling/comparison, which itself was a concession to the failed flag-days
of UTFString that earlier drafts had. Few implementations support it, even
fewer support it as specified (due to the evolution of StringPrep and the
Unicode tables). However, removing the normalization of DNs prior to
comparison creates backwards compat issues that previous drafts prioritized
avoiding, hence the complexity in the first place.


>
>    - I do mean that in full seriousness - and it seems practically
>    unlikely that (2) or (3) can be satisfied...
>
> On the other hand, it seems silly to not make 5280 a standard, seems de
> facto anyway.
>

In the abstract, yes. However, I worry that the necessity of trying to
address (2) and (3) will limit a lot of practical progress.

I think one of the most challenging aspects is that, for better or for
worse, we didn't end up with The Directory, nor did we end up with an
IETF-anchored, protocol-agnostic PKI, nor did work like NADF's work on RFC
1255 lead to region-specific authorities. The consequence is that we have
many PKIs - for different applications, protocols, and use cases - and so
answering the questions for (2) and (3) requires defining the scope of the
problem. When 5280 first began (~2005), there was still a widespread belief
in the federated directory model, as shown by the contemporary efforts like
OASIS PKIA TC. Do we still pretend that is the case - that folks will be
using LDAP to discover certificates ala the Public File - in order to avoid
upsetting the 5280 applecart? Or do we have to also revisit the scope and
context of 5280, so that we can have some basis to measure against (2) and
(3)?

Am I suggesting these are things I want to do, or suggesting we should do
them? Not at all. Yet I also don't see how we might make progress in
assessing (2) and (3), and thus, progress on 5280-et-al to Standards track,
without having to touch on the very scope of 5280, which we know emerged
from a time in which several of the technical assumptions and concessions
predicted did not, in actuality, pan out.

Again, to offer a concrete example of this challenge: policyConstraints and
their handling are an example of something that can be useful, but not
widely supported (and even less widely used, save in "private" PKIs), and
less-widely still interoperable. They were and are a product of assumptions
about how "The PKI" would be administered and federated, which we know in
practice did not manifest. Are they relics to be excised, ala (3)? Are they
things to revisit to add clarity ala (2)? Do we have good criteria to
quantify (1)? The answer is very much "it depends".