Re: [lamps] [EXTERNAL] Re: Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

[Mike Ounsworth <[e-mail]>]

I am also not fully swayed.

I have no objection to the technical content, but my concerns are about implementation and adoption: I'm not convinced that binding certs to each other is going to scale nicely for production-size public CAs.

It would probably be helpful to see a sketch of the intended usage; IE the broader solution that this is intending to be part of. Are you intending to issue a new certificate that is bound to an existing certificate issued months or years ago, or are you only going to bind certificates that are issued together? Are you only binding certificates with the same DN / SANs but different crypto algs, if not, then what are the semantics of binding seemingly-unrelated certs? Can certs be bound even if they are issued by different CAs? (I assume yes because your PQ and Traditional certs will come from different CAs, so does that open a can of worms about people trying to bind an Entrust and a Let's Encrypt cert?). Rebecca answered some of these in her reply, but it's still not totally clear to me what the PQ migration strategy looks like when using this cert binding extension.

It might also helpful to hear from public CAs that are planning to implement this (which may or may not be Entrust; I don't speak for our product teams, but I can connect the authors with them for further discussion).

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Stephen Farrell
Sent: October 19, 2022 3:16 PM
To: Russ Housley <[e-mail]>; LAMPS <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________


On 19/10/2022 20:47, Russ Housley wrote:
> Several people spoke for adoption, and several people spoke against
> adoption.  The I-D authors responded with a response to the concerns
> that were raise, and no one has responded to the authors.  I would
> like to hear from the people that spoke against adoption.  Are you
> swayed by the discussion that has taken place?

For me: No. It might be easier to discuss at IETF-115 though but I've no idea if the agenda allows time for a discussion of non-wg items.

Cheers,
S.

>
> Russ
>
>
>> On Sep 15, 2022, at 11:44 AM, Russ Housley <[e-mail]>
>> wrote:
>>
>> There has been some discussion of
>> https://datatracker.ietf.org/doc/draft-becker-guthrie-cert-binding-for-multi-auth/.
>> During the discussion at IETF 114, we agree to have a call for
>> adoption of this document.
>>
>> Should the LAMPS WG adopt “Related Certificates for Use in Multiple
>> Authentications within a Protocol”
>> indraft-becker-guthrie-cert-binding-for-multi-auth-01?
>>
>> Please reply to this message by Friday, 30 September 2022 to voice
>> your support or opposition to adoption.
>>
>> On behalf of the LAMPS WG Chairs, Russ
>>
>
> _______________________________________________ Spasm mailing list
> [e-mail] https://www.ietf.org/mailman/listinfo/spasm
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.