Re: [lamps] Paul Wouters' Discuss on draft-ietf-lamps-cmp-updates-21: (with DISCUSS and COMMENT)

["Brockhaus, Hendrik" <[e-mail]>]

Carl

Thank you for your feedback and comment.

Von: Carl Wallace <[e-mail]>
Gesendet: Dienstag, 28. Juni 2022 13:22
An: Brockhaus, Hendrik (T CST SEA-DE) <[e-mail]>; Tomas Gustavsson <[e-mail]>; Paul Wouters <[e-mail]>
Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]
Betreff: Re: Paul Wouters' Discuss on draft-ietf-lamps-cmp-updates-21: (with DISCUSS and COMMENT)

Inline…

From: "Brockhaus, Hendrik" <[e-mail]<mailto:[e-mail]>>
Date: Friday, June 24, 2022 at 5:18 AM
To: Tomas Gustavsson <[e-mail]<mailto:[e-mail]>>, Paul Wouters <[e-mail]<mailto:[e-mail]>>, Carl Wallace <[e-mail]<mailto:[e-mail]>>
Cc: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>, "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>, "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>, "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: AW: Paul Wouters' Discuss on draft-ietf-lamps-cmp-updates-21: (with DISCUSS and COMMENT)

Tomas

Thank you for your feedback.

Initially I wanted to go without any concrete recommendation regarding the validity. I only wanted to point out the an undefined validity is not recommended.
I believe, it is not a CMP protocol issue to specify this max-validity, but it is up to the CA policy to do this.

When Paul asked for a concrete guidance, the only guidance on server certificate validity I am aware of is the CAB Forum BR. And you are right, the recommendations change quite often. As this guidance in not normative text, I can live with it.

I could also completely drop the text on undefined validity regarding certificates containing theses EKUs, including the newly introduced Security Consideration.
@Paul, Carl, what do you prefer?

[CW] I don’t see why the validity period concern should result in dropping the entire proposed new security consideration re: delegation via EKU. I thought the proposed section 8.7 text was a good addition even without the validity period paragraph (though disallowing indefinite notAfter where delegating these EKUs seemed like a good addition too).

[Hendrik]
I see your point. Probably I was too quick also removing the whole Security Consideration again.

Did I get your proposal right to add this section again to the draft?

New text:
2.25.  Add Section 8.7 - Authorizing requests for certificates with specific EKUs

   The following subsection addresses the security considerations to follow
   when authorizing requests for certificates containing specific EKUs.

   Insert this section after new Section 8.6:

   8.7.  Authorizing requests for certificates with specific EKUs

   When a CA issues a certificate containing extended key usage extensions as
   defined in Section 4.5, this expresses delegation of an authorization that
   originally is only with the CA certificate itself. Such delegation is a very sensitive
   action in a PKI and therefore special care must be taken when approving such
   certificate requests to ensure that only legitimate entities receive a certificate
   containing such an EKU.


Hendrik