IETF Logo Mail Archive

Re: [lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

Stephen Farrell <stephen.farrell@cs.tcd.ie> Sun, 25 September 2022 14:55 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E08F3C14F728 for <spasm@ietfa.amsl.com>; Sun, 25 Sep 2022 07:55:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.011
X-Spam-Level:
X-Spam-Status: No, score=-7.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a0Vf3TBx9wph for <spasm@ietfa.amsl.com>; Sun, 25 Sep 2022 07:55:13 -0700 (PDT)
Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150108.outbound.protection.outlook.com [40.107.15.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16065C14F725 for <spasm@ietf.org>; Sun, 25 Sep 2022 07:55:12 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=O8eRKVOlN6sTx2Ewg0TdTbz155ClJB+YZTvbG42tmlB9bstLvMt/r9pd3eQ7BuA086k8TYVtpB2M2/vlgqC89u5+ZLAlGO3n5sE4Bc5+GHWE/7ci15zPxtELmybzyMWZH8M27IfLwlEW3CGUxVar9uyXd7EIIEdFAOVxjXfEPz9RD/hfiIuWlEkvJ+9KgHGP8/GEQCbJhaOnhGUEprFVcHxYKSuJ9HXXvutOFNvkZeslEcQU/AyqJB4GTkFECsrX+vEHKi0WqP14ua3CSXY9ZEIXoLgNfMAxca8rXENTiSQ0ikI/3vxxiwGX00Vyan/+xKtC9wn9KNQA/YfwFbznTA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pbLDlcjSOOs34vg3sp9qorXx1rBwNIRQgb7UaOiRBno=; b=ftcmbH+3JMr/Dursf1SfyIxv6F/daD0YkJCC465KS3fTqrsdkoqxlz3q+wpawghkemTmqOA+m9g/ng/jDn4QxY5KDcsMobbtDjGf/2EhgERJ465IOK/nzD+BBADiOPXLlQY95IfUS8MQ9X6zAegGELnwyMunAcYf12afdfYLGNEThT2yN8ScIyZ8lh9u63FLsEkHYi9b6Nqg1emBgI2VatA1fxyotgL4ERVit60Pmbsjd18isvJYPiUDZX1zeyirFrBZs7GovMdJkxXqBqr81lsHR22FWyHPuu8NfORmcFwk/gnLUxOWKA+gPZQDibi3tVPJeQSEs+fRFZqMASPymQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.tcd.ie; dmarc=pass action=none header.from=cs.tcd.ie; dkim=pass header.d=cs.tcd.ie; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.tcd.ie; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pbLDlcjSOOs34vg3sp9qorXx1rBwNIRQgb7UaOiRBno=; b=K8/wk7Xjz1I1Jx66cucgOgdQ/8YcXUC61HBtn3rtM9Wr4MTZGpDnLv6L49F2yWkBeirl2MqFjgXLBi/vDinUyTJu9QmnaHYR8jiNwCBnCM2iIwvCETuS9E2B5PlpBgX+fib6m9CUJh1dcPpOdyLL/KEVzKPlj1YeHpOCmiqD8/ybojodDgd5cvnpZsr5oN8NuFcsAhddTqGvpsh6C4oQkQ836EfBH8il3SalPHFMcYt3/VuTfwUbOe2DRCUp6AX2fmdIIrOCc9qe4AG2xr+MEMgfDbaIsPqb07aVP7c3htPyrzb3KXnHzjoGUK1zSd1LNvW11xhXUlofCuOCYGY04Q==
Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.tcd.ie;
Received: from DB7PR02MB5113.eurprd02.prod.outlook.com (2603:10a6:10:77::15) by AS8PR02MB8493.eurprd02.prod.outlook.com (2603:10a6:20b:541::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5654.24; Sun, 25 Sep 2022 14:55:06 +0000
Received: from DB7PR02MB5113.eurprd02.prod.outlook.com ([fe80::ab27:b708:ed83:b088]) by DB7PR02MB5113.eurprd02.prod.outlook.com ([fe80::ab27:b708:ed83:b088%6]) with mapi id 15.20.5654.024; Sun, 25 Sep 2022 14:55:06 +0000
Message-ID: <593f8e71-2390-64b2-abf1-b4f6d6587626@cs.tcd.ie>
Date: Sun, 25 Sep 2022 15:55:04 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.11.0
Content-Language: en-US
To: Russ Housley <housley@vigilsec.com>, LAMPS <spasm@ietf.org>
References: <PH0PR00MB10003EC6A096FE0A363BBFB9F5459@PH0PR00MB1000.namprd00.prod.outlook.com> <PH0PR00MB10002A7A2850A1333B4F6C00F54A9@PH0PR00MB1000.namprd00.prod.outlook.com> <35BEB1D9-7EA5-4CD4-BADA-88CCB0E9E8F9@vigilsec.com>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
In-Reply-To: <35BEB1D9-7EA5-4CD4-BADA-88CCB0E9E8F9@vigilsec.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------pPqAJHRny6uP7YMZWgKTk8RH"
X-ClientProxiedBy: DB3PR06CA0009.eurprd06.prod.outlook.com (2603:10a6:8:1::22) To DB7PR02MB5113.eurprd02.prod.outlook.com (2603:10a6:10:77::15)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB7PR02MB5113:EE_|AS8PR02MB8493:EE_
X-MS-Office365-Filtering-Correlation-Id: d1602aa8-b1da-4ab3-0fdb-08da9f05eee7
X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True
X-TCD-Routed-via-EOP: Routed via EOP
X-TCD-ROUTED: Passed-Transport-Routing-Rules
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: BKYy8d/AYnv+Ts4SRdkoC9R0mTUt3jk1XWpabq9UJYsRW8GbEyyDT6iU86zSgOMzZAos5YO3EoWejkWimFGQN/xBRYsaK+NYrnEHb6aSkT0BnoG9mx2nfNr35yB22NDxgABLiSDo5XCv9bEbtksP1AyZbjaIbsDuxXcviMbqkX4HexJqnowpYiSFBEuC6YD7KI5x+IsizOMXmahThkDdbpPHMWjuJxUP4pJRIkUpjEvs+Xp1jrEDj1vxjq6SQ7Q3mCgUmO6YxFhHIU7XdqKSFZl+6vJEFjL7Gd7cDR/EiaAy6m8A+e7i6aWJZeqfeRTAdiUMNHfvfn1/LNoNUh7T+/zvEXNi71kN5nc5hxtxOHeP+t/4Imx1jR3x1JBAZbREKdQ03R5lhxEXVp04o3UPUpOmp2KIsn59vs5PuS7AzdCzarQPnjsuycCSzShta6AudqbK8brzQ6PhzulJ92iN8l4m8lpqCUVczlXOmIDK23rp17p+gzuJVbwqsYQ9Zxjmzy/dNXRf6V9oo2E1dn+FaehN2e61zZbd6ZvMqFnOhl0UH6FiDTuFUsOvwT7Ogy6LwM1P9RjDsQAo+cDaOvglDRWm8Yh741cu8pCjZHywh/9J8feI9Osdo6A+PDAj1MWAJPYcISbEJBEg1uJsJoPxLlGsMFGeqF+N0cxgn7T9jbHvpeVrJaJKg/ws5ixBd7cO8lflisagfnqakCv9MjImVsUA7leGYhk2O+Kt0//2/Jf3GbCiX03AG/rL5774bUhnfQvnhJLJm6tV5Nd8OAixL3315FwK5pgvJk71/EWC9qY+d9WejhhKRwWlym/IwZDE
X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB7PR02MB5113.eurprd02.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230022)(4636009)(376002)(136003)(39860400002)(366004)(346002)(396003)(451199015)(44832011)(83380400001)(110136005)(38100700002)(316002)(786003)(2616005)(36756003)(5660300002)(2906002)(235185007)(53546011)(6512007)(8936002)(86362001)(31696002)(186003)(41300700001)(8676002)(66556008)(66946007)(66476007)(6506007)(31686004)(33964004)(21480400003)(6486002)(966005)(478600001)(45080400002)(45980500001)(43740500002); DIR:OUT; SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: hFrZ9V4xGZCIC8lCN4tlOgtvforA91INSc2BZ59J2b4chVPb86JfSGE9NIlHZQL9wCad3qbO6+GGWmVgTIzYmyaVQgOTB6wupUJzkidPL30uuBxJfqMmo/c7hWJP+yEv5b7EnfuIxraOjibbqSQUDXovmhmtcqgBCu6mCnaLsgjOwKqFMcPRn5BoJ5M5Qr2xjokphwAq/AqkkbiVt8cHkqEq/QsGOD3fW1VOPtxFUUN6axkIenTHy++Yj5K/oVxgRwTMxSoLLgrwRwzS5nO98RasJ8Y2i+To00zQQgqn+kdnJaXBWpJTSpWCEHpq71GDhqxOYodHsTLNSSOvWyDJwY5GQUAKqxsnJFL7aAHXAt5yB719p60UKH0l2KNgx0I/1nS3PzE6ltVw+IP6WLOL+3hmGOs9+paAh2po6s23JLq2ijTgg+WIU90UeY0LYPL5+eHaphkasZOlBA539aIMtBMLe8uJVqvJcyIBwz+gZpnGLILTr1gB6qzGvXBgSKmgRrDXs3SNFyu3v7r8MuXmgH6omYUyecl+V+A+oPcQUa2h9YHEgfDNB5X3GMS5kA64i/xyXQdcefh8//KHZOWg273AlIMkVwUw8P+miMcHj0A0/Dj3ipqLoifpvM+jZ99+4gKD+o1UWGf2PZaklQ2fBVsPEoAo8rFKVLXx7N9zYLTDs0TmTPjsOPq68Mgl2SGi4Mh2ssJO5j0U2JKvt2uLoOvUdt3zXgxs3/JOkDQ3p3BlDab7EVzK5j1sOS5QvSIfxTbNP9/DGPYt52XVJiDIVYZtrw6KeKx2y7Z3c3zoxgWLy+FOmF+oB+JKrRxU0HaCTW3m4xw3Do/Rr6L9gL0kKKhAjyD/V+ueS/ZEZxuZC9Z3OPyizRa6liCvqlAHE2iEZWjOjrNSwr6hOcDU9qxTCI5+LLzTjExZPc/DHKiTNe35WSBGo7fpbykO+1BjV53KjZHGVQYVt73ooLnIov/WILotFtasWIn13OMimOgZngrN2JYasx1EWSdd9xzAZl+gze3WShqoGhKuoBS9vPOJk6KEZa28R9ErfKRgLKrstiVupL+m+xbqFS9XuD4898AXx4lYNhasG5WexoJMWg7U9vb3G6btD28hTRl9anp3T/GmbU+xZwu+V5SrTAWljNV0AMnKCk5U4BIu56Zqze5Jgr1XXSvhp5VB9S/Y+oh2nXxsfZjlquiJNfZW8fQJPnrXIt+YS0CHO1HfclN9e5GOlEEhLYjipdSBOjN/XORZuZi6l547MrvNgpmrPGt+CJPJGOViGnY/UR43kuNfn0g5xwznkZgnZ/cJmWd3IuXlYadpRzy9V36EuSo9eroIkROGyonxtMHi9wVJ0f6pluWVHaw3qZgoS3F08ny7Fh25+2tbShAAoT9sjZgci4Em+7ev6y9UTuWUbXGtvsahKmUhpOcUXk9CLKXYAB/MANWPSoOcruKRyB+VsKfkzwo2rW9vWsXpxn4ZgiruzlmadHeqrkygayCvCHevDITvtJ8MxE4JGegrNdgKZImP0Ueo0e0tMZY13/TP0dL+pK5mFFaugiWsIha+F+WSchHC3x2+fHVeonyItWIdi3qGMGDJyfyxhQ0EPf0Rr7QtGzbM12Fdf4Yf3MtTiCCZhGCnGICVxNZFoQZ6bVjFYUkFmpKu+bUW
X-OriginatorOrg: cs.tcd.ie
X-MS-Exchange-CrossTenant-Network-Message-Id: d1602aa8-b1da-4ab3-0fdb-08da9f05eee7
X-MS-Exchange-CrossTenant-AuthSource: DB7PR02MB5113.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Sep 2022 14:55:06.2025 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d595be8d-b306-45f4-8064-9e5b82fbe52b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: osFPw3JYuYy6VM8vyRhLr2BMymWYPFXvH9en0nvVfr1+vr0F6/imP6F8R4r1Y+jf
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR02MB8493
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/fPY22easVg_WqR147Vkj6HWZe0s>
Subject: Re: [lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 25 Sep 2022 14:55:18 -0000

I had a read of the draft. I do not support adoption. ISTM
this could turn out to be quite a bad idea. Adding such new
complex requirements to existing PKI libraries that may be
brittle already seems far more risky than waiting to see what
PQ authentication stuff is really needed. (IOW, doing this
could reduce security overall and increase risk, so... how
about we don't do that?:-)

It'd be a better plan to wait and see what TLS and S/MIME
etc turn out to actually need in practice before doing any
such work.

Cheers,
S.

On 15/09/2022 16:44, Russ Housley wrote:
> There has been some discussion of
> https://datatracker.ietf.org/doc/draft-becker-guthrie-cert-binding-for-multi-auth/.
> During the discussion at IETF 114, we agree to have a call for
> adoption of this document.
> 
> Should the LAMPS WG adopt “Related Certificates for Use in Multiple
> Authentications within a Protocol”
> indraft-becker-guthrie-cert-binding-for-multi-auth-01?
> 
> Please reply to this message by Friday, 30 September 2022 to voice
> your support or opposition to adoption.
> 
> On behalf of the LAMPS WG Chairs, Russ
> 
> _______________________________________________ Spasm mailing list 
> Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm

v2.39.1 | Report a Bug | By Email | System Status