Re: [lamps] Call for adoption for draft-ito-documentsigning-eku

[Daniel Kahn Gillmor <[e-mail]>]

On Mon 2021-08-16 16:39:01 -0400, Russ Housley wrote:
> Many people have spoken in support of this document, and two have spoken against.
>
> If it is to be adopted, an addition to the chart is needed:
>
>    The LAMPS WG will support new definitions of objects registered in the following
>    IANA registries: SMI Security for S/MIME Mail Security (1.2.840.113549.1.9.16)
>    and SMI Security for PKIX (1.3.6.1.5.5.7).
>
> What do people think about this approach?

The above strikes me as an extremely broad change to the charter,
permitting apparently arbitrary work within LAMPS as long as it manages
to touch those IANA registries.

Both objectors to and supporters of the proposed document-signing work
appear to be concerned about proliferation of Extended Key Usage (EKU)
OIDs with semantics that are ill-defined enough to produce interop
failures, and to potentially increase the costs of certificate
management.

I can see the need for a document-signing EKU that is neither for code
nor e-mail messages, and if relying party (RP) implementers are
interested in implementing an EKU check in specific contexts, i can see
the reason to adopt this work in LAMPS -- so long as the document under
WG control grows sufficient details to actually promote sensible
patterns of interoperability.  (though if the RP implementers are mostly
found somewhere else, i have no objection to them coordinating in a
different standards-body setting to specify a doc-signing EKU)

But opening the charter wide to encompass any work that happens to touch
one of the arcs mentioned above seems like writing a blank check.  Maybe
that's what the WG wants to do, but it doesn't look like it will help
the WG stay focused.

I'm not sure why the charter needs this particular update.  Would adding
"… in the direct service of the other goals in this charter" to the
proposed text satisfy the charter revision needs to consider this
document for adoption?  If so, it would help avoid looking like we're a
dumping ground for anyone who wants to try to claim a point in either of
these arcs for any particular topic.

      --dkg