Re: [Spasm] Let's focus

On Thu, May 26, 2016 at 1:04 PM, Richard Barnes <rlb@ipv.sx> wrote:

> Hey all,
>
> I'm concerned that the proposed scope [1] for this WG is (1) too broad,
> and (2) inconsistent with the participation so far.
>
> The breadth concern is evident in the ambiguity of the name "Some?"  This
> group should identify some concrete, practical problems in the Internet
> they need to solve, describe them, and demonstrate that they have the right
> set of stakeholders to develop, implement, and deploy a solution.
>
> I'm personally most concerned about the "fix the EKUs" milestone, at least
> as it's realized in [2].  From the perspective of someone who works a lot
> in the Web PKI, this sounds like a request for a feature that has negative
> value.  The incremental value of the proposed feature would be to allow
> "everything but X" CAs.  Recent experience in the Web PKI has driven home
> how harmful it can be to have divergent sets of RPs relying on the same
> PKI, so allowing CAs to be more unconstrained is moving in the wrong
> direction.  I'm not dogmatic on this, but in order to be persuaded, I would
> need to see active interest from some real CAs, and from the logs of this
> list, I'm not seeing anyone who's a current participant in the Web PKI
> (apologies if I've failed to recognize someone).
>
> I'm also concerned about the "SRV for cert stores" milestone, though I
> admit I'm not as deep in this space.  Looking at the proposed doc, it seems
> like the SRV adds any value over just looking stuff up at a well-known URI,
> e.g., adding a "x5c" attribute to a WebFinger resource.  Anything that
> requires special DNS magic (and SRV counts) is going to face significant
> deployment barriers.  So I would be happier if this were a "define a simple
> cert discovery mechanism for S/MIME" milestone, rather than being bound to
> a specific mechanism.
>
> Overall, it seems like this group should focus on moving the ball forward
> with regard to making S/MIME deployable in today's Internet -- fixing
> papercuts around AEAD, i18n, and cert discovery.  The PKIX stuff is
> unrelated and addresses an entirely different constituency.
>

The certificate i18n email address draft is actively being worked on.
Probably a next rev posted next week or sooner.

-Wei

>
> --Richard
>
>
> [1] https://datatracker.ietf.org/doc/charter-ietf-spasm/
> [2] https://tools.ietf.org/html/draft-housley-spasm-eku-constraints-01
> [3] https://tools.ietf.org/html/draft-bhjl-x509-srv-00
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>
>