IETF Logo Mail Archive

[lamps] Re: Draft leafy greens feedback

Peter Gutmann <pgut001@cs.auckland.ac.nz> Sat, 29 August 2026 06:49 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 32F7D1316149A for <spasm@mail2.ietf.org>; Fri, 28 Aug 2026 23:49:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1787986181; bh=IsKDVZFO5jAToFy2DLN/lytzojApB8J1aSS+z0tuWSA=; h=From:To:CC:Subject:Date:References:In-Reply-To; b=nFKhVGt71N9xoGS+m01VgKaPcOyC2F6bBBI+2kZz6+T0p/QTbLiv4RgA4qgOQlNIO cxS1G/qhWeB8OB/yn34Pfl0a5aKtLV2pDQ22LHwvvDxbBnPZ4qJG2XwcNFTelVchp+ bX9LHSvdKOXlJf6UGicVmW+kVug8BEAZU6J1XPxA=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id St_YfSIH7qcL for <spasm@mail2.ietf.org>; Fri, 28 Aug 2026 23:49:39 -0700 (PDT)
Received: from SY2PR01CU004.outbound.protection.outlook.com (mail-australiaeastazon11021142.outbound.protection.outlook.com [40.107.39.142]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id A4BF813161495 for <spasm@ietf.org>; Fri, 28 Aug 2026 23:49:38 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lWhT4weUtdNXZ3gIOpVlGC/uGGAOs1Ls1VJtSRCac4bC+hdpL4kPKbWHs3dkWxFtQP2A5bOqO3KaOoKRgqJ//mekQ9rocxHSnkrJkdAZw/VUTx1sZfbYwsjGN9sbPTWgg8IsIAijY/DffVEVIQYXZzT/aPoMJv5vGRQFP7C0VilJv0buMT/W4DjEJ0c7caG4zekQ15nIvYKSD7wREKHu4cOjCE3xPfwTUHAGP5r/vQnGizpYBPvII0XKX6KAWkf4L2weV0inMrGUb6pMI9X0Jesz5RdWal/00hqlGwwosd5qgTHKIUyj60rk/9fBIzN0RK8Jkmo/k5BG8N5C0LfJ5g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ox+DWhfRAF8eNAu8HSJiFyTDKPPT5KyT97zFsPNrNUk=; b=a5thBTRmeVJD0rFtFQ0o6woHXugph3+zMLUqpA6GRQZvhSO2J/MnlTwWNV3xGxBimtREm+amM7JwMNH3iV+n+iOWyNlXk5RT2w00yprVXUxn9XWbktGQNCCx6/Cbm2A2Sk84gcxmh8JPtXpG72FtBjFgkONRO+pmX8BPKXTV/Rwuox1JShfiWeyL2zWWiS8cdkRwJFkhmq7rXt2XPvr5pTodTnmQLq4j5QACca/VZG4NdrG8kOqzBQ0htNH4MMo2dpUM4bGBPoR49sFbDRosEqrBq8acXxN/YytGZ2zM8rLotGKQYK9gDgz5yKvzwK7GGuuaTBqrQ/UOaBz805//gQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ox+DWhfRAF8eNAu8HSJiFyTDKPPT5KyT97zFsPNrNUk=; b=dMQRXt4rr0u1NB/1L952ETViIM2Pqzc74vmX4NLc4jz5KwBtu5gynswLlm31CAYuIdCsgbHjCrV5GlM16xw0TYpCi8KpJXlva0oLcNhTTpGn8I3ezcO0gQNCnjZnvdTY41N1KYqCoOAgsAWyAYWm67r4aB8rRkMbNtOP2zWqd/XMRCCRmF7WzGbhhiKDs82tdrXDHmAYE/4e9S+q4EVI4EZExfeAcXMb7rjGkRJ6qSxgwzfuP/B40Y62eyLEtYInBEhW4804pjVT6GKCo2IxzXbGDOkMjHoauOs0LYppNHtlEq8xoH54PWRvWRoRdACSpo56BwB7lxpNeM4L1WFkBA==
Received: from SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:348::15) by ME0P300MB0636.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:22a::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.12; Sat, 29 Aug 2026 06:49:25 +0000
Received: from SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM ([fe80::726d:6aa2:f24c:e365]) by SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM ([fe80::726d:6aa2:f24c:e365%5]) with mapi id 15.21.0360.008; Sat, 29 Aug 2026 06:49:25 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Mike Ounsworth <mike@ounsworth.ca>
Thread-Topic: [lamps] Re: Draft leafy greens feedback
Thread-Index: AQHdGc3otfAo8A5k3k29Dgln1IQCTLZ59J4AgCLHAICAACxzAIAGRyDOgA9Fy4CAAlxYIA==
Date: Sat, 29 Aug 2026 06:49:25 +0000
Message-ID: <SYDP300MB2666705306DC78091920624CA5EEAB2@SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM>
References: <aR6haSXuG4DWv1CHNnpxjXz8HDrSr3QTaTucL0UDij-cG6mIILulEuh8x_TXW8em7iuY5EYLZZkI1rAGCKtXYPnmumjzpGhq3zZ5h17eDlE=@ounsworth.ca> <AB899736-51AB-41DA-9797-FF35D171EA91@obtuse.com> <91D27DD3-027C-4450-99A1-34012DB9BF2B@redhoundsoftware.com> <CAF8qwaAhk1zkLRiB8c1GMsX2wGP6zD9eg_oYvA=T5XxjyixPOw@mail.gmail.com> <26798B65-AA85-4EB0-90B5-1FAF8F495C3A@redhoundsoftware.com> <SYDP300MB26667065BE164EC005937637C0EEA62@SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM> <krld6BZjZWdAlzq_YxGR8hIbrVrxu9fmNZYwTKfOJvoreVWLYzSF-Viuo9LN-BOPt4r4YVXgj8294IUr6dGECDfzJ33RhK5e1W6rwarf7QQ=@ounsworth.ca>
In-Reply-To: <krld6BZjZWdAlzq_YxGR8hIbrVrxu9fmNZYwTKfOJvoreVWLYzSF-Viuo9LN-BOPt4r4YVXgj8294IUr6dGECDfzJ33RhK5e1W6rwarf7QQ=@ounsworth.ca>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_b75eb9d1-7479-4f8a-9240-cc5b19dbbc64_Enabled=True;MSIP_Label_b75eb9d1-7479-4f8a-9240-cc5b19dbbc64_SiteId=d1b36e95-0d50-42e9-958f-b63fa906beaa;MSIP_Label_b75eb9d1-7479-4f8a-9240-cc5b19dbbc64_SetDate=2026-08-29T06:49:25.267Z;MSIP_Label_b75eb9d1-7479-4f8a-9240-cc5b19dbbc64_Name=Internal;MSIP_Label_b75eb9d1-7479-4f8a-9240-cc5b19dbbc64_ContentBits=1;MSIP_Label_b75eb9d1-7479-4f8a-9240-cc5b19dbbc64_Method=Standard;
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SYDP300MB266670:EE_|ME0P300MB0636:EE_
x-ms-office365-filtering-correlation-id: 237ce765-43e9-404a-a991-08df0599aa4b
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|786006|376014|23010399003|1800799024|10070799003|366016|38070700021|4143699003|10067099003|11063799006|56012099006|22082099003|18002099003|3023799007;
x-microsoft-antispam-message-info: /YvtwnjfRAlueCOMrdlSGIi+6pBXtflmeE1Ov/9csi3dJb5+cw8/qcOC0/T7Q/HMoKg99rb5Md98GLKHoGFQtkB3kS5z4bGrd7NJg/VB5xscc9HZQXYaWTDRYU6KbqWLhFLGe9EzrnMx3RH5jvD0ozgjHLJPvJ6tRmlGkXQGB2LHO42VCTxgabYEpqDXkxdmVzhK4jipp7dtbqy2O1H54Ty6ShImJf5iqcc1FyNIT8Eyg5dZ/vcv0GyL/akoQ6h7jE9B8axOkhxGS91AqnmotWp+jKnR2uiVC0XEGgWThJBi2xeUjgxU7TpRY5A1/I/ARUzmhedt+8WPal8qiWeE9/ykqzwqHsyGIgm5uXDJpJ4fmmqzigSZXQ6VrmKlz7imEdGBh7+I1rhxPgJE9yOJ47lJ6mUqHYTKAgH2Yz5Rr5UMO6a6lXSd1yJ1A/mYNrkjmVHuYr++uVGfXkqOvEi4fzjNL5EctRany666SLkk22KxfnCdifDf1iVLTtpZPYXELUCWBEjzxEp5yhFDW6iHKUJ8gMJNkJmPCDHNs17Qi/wRy5WcazjnVl0oOYUo9vxxmDMCbwZIwsfoFzgqge6CuFn7Nui6UiA/aQA/8z1/MWC2YB3E57Nta9ytnRlJa603xncQHmG8pDeqXYkVY10sP54VM6xoHkSxYXjepmFqvS9CxtPeN/LKmTzHVWpPGI+1ixaIBN84slyxmggY1fVRyA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(786006)(376014)(23010399003)(1800799024)(10070799003)(366016)(38070700021)(4143699003)(10067099003)(11063799006)(56012099006)(22082099003)(18002099003)(3023799007);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: tAJkfUp5rMe1JVerTww41rnSS0P/cbXoGq5R+ukInydTnElz8QDFHLYR7HmoEXHx2OQYO4K/G2PpO9aM8UFvrbyHrs3xzMx8TjRWvrsSPuZHB0zNfWl8oVtrzlFVgqVwMEXkhU1hooQ0rqnsiktNO2QeNT8axq8020+4w4ighmHcfL3Ma4dkzT79551miY3jAzvghaPedBlaM+fUd8MpkW8HddAw4aM9c/Q4KF1k6hMHXuf0f7uVTD9bz8IrDZGVmZ+fFM6VEW7dzO+tQPAOejj+1DLXw2d6zszrJv77EjAJ0ify7Ej7paMuHOpfUzQqU1mP5uuhiPQvhiPmwG6xwK5mgXD00GNgfvR2C51ya0WO2GPoUZzhJNRPqdtxhM5cLvoqtm3z8Ik8J4lVWDLaRY8tL1FeoNNcnPzLcGFJWsIbHhpRyXcVMMQnbnAjy+qVy9fW8kUwiVXO5QjWFX3gT+LcjiXqL+nFrLq6De5yxYCd8WRHv7i3nxs32A7U28+G/mCyPZxeyVOkRzwXiXu9Txxasx3hpDBux7OG1MNyH9fEOjdGZjAcWsVy0Z5/KbxDH1NL/N8f0D8DXoiFRX8NrGhFyI7eg/cbNPpTt1PAJLjrZEbNJhLDh29ZF8lScKmGo594LJPPChDXWnLrzCHGcEt3u42J9QSa9iL7TlPsiJT2VxpQtmTe8P7NHX+FGlJCMPCrZMr9mjQ+7qqED3Ikanld0VYzHP+kI+d86rYkz0+U4K/3Jj5oy5bErJweDt5V4iU3StvSkpC0kqwKoiiJCNBIFrScSK2abM1Z1meu7DRTVaMa/YGvtUGTEf+A8pYAI6QnJn80t7URi/TuYAWJcfgZMkp+vSAtiQuqmrELEDzRNALV/DWI2/0M+2So13v3Rbbw5mJMYl5cdzgUFi6mPS/i2jMtiADsa5G1p63Ez1YHikV+bNLpTnAzbq1rpwGbPdSs5OvSAAb4euFCoB0k13W+dfxlgJPLS0N77RuSxMcEQ3wXKdkuFfWhQo1M9TIKr34GsJO0LVt5POaaqPWSOJtKwgNHp0uuN1zp2iqEXR9NaoNAc1bKlIibdgN9xHTSyr5UdqRhNLcEBBylfLcjszE9zpZWP/9DRbIA4ZX6FfgA/H7Ciwz3/Fn14HttefgqZbFuNxIIiuL5eH3AeC05jCJMZqpiVBKywQ2nWvrCoC+MOaD0DTVv1OOM7/RJmJi0u2YLSLZfKAt0lSovZ/e0Lg9/j0Ke5BzxTW7J6Ygrkm4tWEe3oXjtf3RYioR9xD0ieFcywNrXeEe7l85N+r1JnyaAC8PGWyVM6oljck1qucvivJwYZPG8PJyq5DYSruDop8PrH6a30Fih5r18IUM1tiwoQ5cIGc83HA7HWfM/1assQkZzSBdlw5AxTfsRAUHBVatoxCKgPm6NjXPVE70U9cjl6VuNHloJ8hlcV9AtG5+qLc83XYeJ3aeb0Wjr4rgwQmqUEFyAEvGoPimhU5socH0ySqU7X+PADhkk8k3+TutwyuXnOtWC1t+scDpaUihqOTE5hrUDhoHqJMSDcnHDAlcQ40CbjK+L2mQZLGByVhF57iMkfWQGuSgO3lvanMXr6umX/TwlKHeTYD6qH+79R/7zUqBbVsP5T2CAkLSfUS+UbtRyE+S1n79MoY0ySsTNaRrPSAHr/wqanYrOK27pNNU9iNsk6kYtbHORQQd+pbEj+U+5XfMQO6upxAgDzxHTpujxp61djhW7irRQlEdPHO5qEr8BoBmdFR08S/H7ziadz9+1I5ln7LlWcsXbLRAX1C2J9z3j
x-ms-exchange-antispam-messagedata-1: 81/th3ODkEI+Vg==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 237ce765-43e9-404a-a991-08df0599aa4b
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Aug 2026 06:49:25.4818 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: PIdsqOVC5qZDVXsiUJgVlqCFIXE7XNOjBYQiCo9DzvQxGkhMSmFpex2TfgyqRC9CGXhRRAT0qKugO2vczUcZH7tDtOFIf2NeOAGFRSwlas4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: ME0P300MB0636
Message-ID-Hash: NWY2P6II6ZDYQMOE5BCZSDNCJFSNGHZR
X-Message-ID-Hash: NWY2P6II6ZDYQMOE5BCZSDNCJFSNGHZR
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Carl Wallace <carl@redhoundsoftware.com>, David Benjamin <davidben@chromium.org>, Bob Beck <beck@obtuse.com>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: Draft leafy greens feedback
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/UvJSeij4nDof2OD4B89TF6_83zE>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Mike Ounsworth <mike@ounsworth.ca> writes:

>NameConstraints -> excluded subtrees are broken for dnsName SANs with
>wildcards. Nobody disagrees with this.

They're broken for all use in general, not just dnsName SANs.  They're almost
trivial to evade with creative encodings.

>Does any real PKI use excluded subtrees, or are we talking about solving a
>theoretical problem with a vanishingly small deployment base?

My code has thrown an exception for them for between 10 and 20 years (I'd have
to check the change log for the exact duration), with a note to contact me if
you see this message.  So far, no-one ever has.  This is for embedded/SCADA,
not web use.

Peter.

v2.46.0 | Report a Bug | By Email | System Status