Re: [lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

[Michael Jenkins <[e-mail]>]

If there are no technical showstoppers, I don't understand the objection.

Mike and John have a well defined scheme, for which they have prototypes
and apparent customers. So that will exist.

On the other hand, singleton certificates will also exist. The US DoD will
have oceans of them. So will companies with limited resources that will
balk at the idea of being sold something they already have bolted to
something there's apparently lack of confidence in. Singleton certificates
will exist irrespective of our draft; we are not creating a necessary
precondition.

All our draft does is provide an indication of assurance that one
certificate is related to another. The specific relation is that the entity
controlling the private key in one certificate also controls the private
key in another. Those certificates exist separately. The relative context
of those certificates (validity period, etc) would have to be part of a
transition plan.

If you don't like the mechanism, if you don't understand it, if it doesn't
fit with your transition scheme, you don't have to implement it, or buy it.
If you encounter it, you can ignore it. On the other hand, if it fits with
your transition scheme, it can add some assurance. This is explained in the
overview of the draft.

Mike Jenkins
NSA-CCSS

On Wed, Oct 19, 2022 at 11:03 PM Kampanakis, Panos <kpanos=
[e-mail]> wrote:

> Hey Russ,
> I have not been convinced either. My details for the operational
> challenges this draft would bring still remain. Willing to hear more
> counter-arguments from Rebecca and Mike to address the concerns or discuss
> it further.
>
>
> -----Original Message-----
> From: Spasm <[e-mail]> On Behalf Of Russ Housley
> Sent: Wednesday, October 19, 2022 3:47 PM
> To: LAMPS <[e-mail]>
> Subject: RE: [EXTERNAL][lamps] Call for adoption of
> draft-becker-guthrie-cert-binding-for-multi-auth-01
>
> CAUTION: This email originated from outside of the organization. Do not
> click links or open attachments unless you can confirm the sender and know
> the content is safe.
>
>
>
> Several people spoke for adoption, and several people spoke against
> adoption.  The I-D authors responded with a response to the concerns that
> were raise, and no one has responded to the authors.  I would like to hear
> from the people that spoke against adoption.  Are you swayed by the
> discussion that has taken place?
>
> Russ
>
>
> > On Sep 15, 2022, at 11:44 AM, Russ Housley <[e-mail]> wrote:
> >
> > There has been some discussion of
> https://datatracker.ietf.org/doc/draft-becker-guthrie-cert-binding-for-multi-auth/.
> During the discussion at IETF 114, we agree to have a call for adoption of
> this document.
> >
> > Should the LAMPS WG adopt “Related Certificates for Use in Multiple
> Authentications within a Protocol”
> indraft-becker-guthrie-cert-binding-for-multi-auth-01?
> >
> > Please reply to this message by Friday, 30 September 2022 to voice your
> support or opposition to adoption.
> >
> > On behalf of the LAMPS WG Chairs,
> > Russ
> >
>
> _______________________________________________
> Spasm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/spasm
> _______________________________________________
> Spasm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/spasm
>


-- 
Mike Jenkins
[e-mail] <[e-mail]>
443-598-7837