[Spasm] Let's focus

[Richard Barnes <[e-mail]>]

Hey all,

I'm concerned that the proposed scope [1] for this WG is (1) too broad, and
(2) inconsistent with the participation so far.

The breadth concern is evident in the ambiguity of the name "Some?"  This
group should identify some concrete, practical problems in the Internet
they need to solve, describe them, and demonstrate that they have the right
set of stakeholders to develop, implement, and deploy a solution.

I'm personally most concerned about the "fix the EKUs" milestone, at least
as it's realized in [2].  From the perspective of someone who works a lot
in the Web PKI, this sounds like a request for a feature that has negative
value.  The incremental value of the proposed feature would be to allow
"everything but X" CAs.  Recent experience in the Web PKI has driven home
how harmful it can be to have divergent sets of RPs relying on the same
PKI, so allowing CAs to be more unconstrained is moving in the wrong
direction.  I'm not dogmatic on this, but in order to be persuaded, I would
need to see active interest from some real CAs, and from the logs of this
list, I'm not seeing anyone who's a current participant in the Web PKI
(apologies if I've failed to recognize someone).

I'm also concerned about the "SRV for cert stores" milestone, though I
admit I'm not as deep in this space.  Looking at the proposed doc, it seems
like the SRV adds any value over just looking stuff up at a well-known URI,
e.g., adding a "x5c" attribute to a WebFinger resource.  Anything that
requires special DNS magic (and SRV counts) is going to face significant
deployment barriers.  So I would be happier if this were a "define a simple
cert discovery mechanism for S/MIME" milestone, rather than being bound to
a specific mechanism.

Overall, it seems like this group should focus on moving the ball forward
with regard to making S/MIME deployable in today's Internet -- fixing
papercuts around AEAD, i18n, and cert discovery.  The PKIX stuff is
unrelated and addresses an entirely different constituency.

--Richard


[1] https://datatracker.ietf.org/doc/charter-ietf-spasm/
[2] https://tools.ietf.org/html/draft-housley-spasm-eku-constraints-01
[3] https://tools.ietf.org/html/draft-bhjl-x509-srv-00