Re: [lamps] Call for adoption of draft-nir-saag-star

[Russ Housley <[e-mail]>]

This document was discussed at IETF 102 in Montreal.  the DRAFT minutes say:

'"""
A WG call for adoption is underway.  This document is about Short-Term
Auto-Renewed (STAR) certificates.  There is no revocation information
for these certificates, and the short validity period of makes this
acceptable.  The automatic issuance of replacement certificates
overcomes the operational challenges of short-term certificates.
Two use cases are driving this work: IPsec VPNs and software-defined
storage.  These certificate might not be suitable for the Web PKI.

Many people in the room felt that an extension for that tells the
relying party that no revocation information is available is needed.
The authors feel that such an extension should be defined in another
document; this document should remain a BCP.

Some people felt that these certificates should point to an empty CRL
and a similar OCSP responder so that anyone looking for revocation
information would not get a failure.

Some people felt that the WG should not adopt this document until
it addresses thes two topics.
"""

My conclusion from this discussion is that an update to the Internet-Draft is needed for the LAMPS WG to consider adoption.  Please speak now id you come to a different conclusion.

Russ




> On Jul 14, 2018, at 12:01 PM, Tim Hollebeek <[e-mail]> wrote:
> 
>  
> The recently approved LAMPS WG Charter adds this work item:
>  
> 3. Specify the use of short-lived X.509 certificates for which no revocation information is made available by the Certification Authority.
>  
> Short-lived certificates have a lifespan that is shorter than the time needed to detect, report, and distribute revocation information.  As a result, revoking short-lived certificates is unnecessary and pointless.
>  
> It has been suggested that the WG adopt draft-nir-saag-star as the starting point for this work.  Please voice your support or concerns on the list.
>