Re: [stir] certificates: short-lived or status

Richard Shockey <> Thu, 16 March 2017 14:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3AE9712955E for <>; Thu, 16 Mar 2017 07:56:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.706
X-Spam-Status: No, score=-2.706 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.796, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (768-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id RQiiP0JV6GS7 for <>; Thu, 16 Mar 2017 07:56:50 -0700 (PDT)
Received: from ( []) by (Postfix) with SMTP id 597C8129573 for <>; Thu, 16 Mar 2017 07:56:09 -0700 (PDT)
Received: (qmail 4970 invoked by uid 0); 16 Mar 2017 14:56:09 -0000
Received: from unknown (HELO cmgw3) ( by with SMTP; 16 Mar 2017 14:56:09 -0000
Received: from ([]) by cmgw3 with id wer61u00u1MNPNq01er94x; Thu, 16 Mar 2017 08:51:09 -0600
X-Authority-Analysis: v=2.1 cv=WOnsABcR c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=1oJP67jkp3AA:10 a=6Iz7jQTuP9IA:10 a=ZZnuYtJkoWoA:10 a=PeFO9FbFhS32YxYntvkA:9 a=yChfmJklAAAA:8 a=48vgC7mUAAAA:8 a=scBmumm3AAAA:8 a=zQP7CpKOAAAA:8 a=hGBaWAWWAAAA:8 a=RpNjiQI2AAAA:8 a=8gzjc8pvfPV_fJbbIaQA:9 a=jpIH26JlB8aEU1M81S3jpgcb7nU=:19 a=9V1SQCVd9teeSwwb:21 a=Zp8D_aozahhsdptG:21 a=QEXdDO2ut3YA:10 a=qM39cor4HRgA:10 a=K2lU_Ab98eoA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=Gi5dtDlrkZ0VZO41OIYA:9 a=IFO3xCr342yGHJ2A:21 a=v4MT-_KzNocYPuE7:21 a=HuF49OC1PnA2FLuM:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=mJIR4eSbOWsPzGlFEEeA:22 a=w1C3t2QeGrPiZgrLijVG:22 a=ef56qr_8hkesV0SKvPxj:22 a=obGFCI3_7AGB19sD6zJV:22 a=Q-ofuW86YyylptHqTH-7:22 a=vJuR_VyAocOa-HWBgGQO:22 a=BKKCjISod1eDJeS0ORpz:22 a=zjWhRoSqWz9hl55Hdlzg:22
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=default; h=Content-type:Mime-version:In-Reply-To:References:Message-ID:CC: To:From:Subject:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=hNjG9lUkGbg25X6U0AC6i+CxlMXGl81GHRjzUpa0l1I=; b=QZahQNDcTOPLn8c//QnwK9ExTs JEkiG2QWIf3S1xy6Wb2fO2dVpI2lSUpqiQB1PjTFxaAjHgQQk9Ob0uuh/2vdGdscG2zuLGDq8H+Aq SbI8prl6Tazocu333Gu2BbuPu;
Received: from ([]:50927 helo=[]) by with esmtpa (Exim 4.87) (envelope-from <>) id 1coWk6-0006AB-Bd; Thu, 16 Mar 2017 08:51:06 -0600
User-Agent: Microsoft-MacOutlook/f.20.0.170309
Date: Thu, 16 Mar 2017 10:51:04 -0400
From: Richard Shockey <>
To: Tony Rutkowski <>, "DOLLY, MARTIN C" <>
CC: Richard Barnes <>,, "Peterson, Jon" <>
Message-ID: <>
Thread-Topic: [stir] certificates: short-lived or status
References: <> <>
In-Reply-To: <>
Mime-version: 1.0
Content-type: multipart/alternative; boundary="B_3572506266_2077468087"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname -
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain -
X-BWhitelist: no
X-Exim-ID: 1coWk6-0006AB-Bd
X-Source-Sender: ([]) []:50927
X-Email-Count: 18
X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ==
Archived-At: <>
Subject: Re: [stir] certificates: short-lived or status
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Secure Telephone Identity Revisited <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 16 Mar 2017 14:56:53 -0000


We haven’t seen the final Report and Order yet. ☺  Stay tuned.


Yes Virginia there really are protocol police.  See 47 U.S.C Title II  ( as frequently amended)   


See also



From: stir <> on behalf of Tony Rutkowski <>
Date: Wednesday, March 15, 2017 at 11:13 PM
Cc: Richard Barnes <>, <>, "Peterson, Jon" <>
Subject: Re: [stir] certificates: short-lived or status


What threat of punishment? There is none in the proposed rules.


On Mar 15, 2017 7:58 PM, "DOLLY, MARTIN C" <> wrote:

That's why we have governance and the threat of punishment by the Feds 

Martin C. Dolly

Lead Member of Technical Staff

Core & Government/Regulatory Standards


Cell: +1.609.903.3360



On Mar 15, 2017, at 7:47 PM, Richard Barnes <> wrote:

So you're trusting the folks issuing certificates to be perfectly reliable, and service providers never to use a cert for a number that's been ported away?


On Wed, Mar 15, 2017 at 7:42 PM, DOLLY, MARTIN C <> wrote:

I do not see the need for short lived certs for a TN call setup service

Martin C. Dolly

Lead Member of Technical Staff

Core & Government/Regulatory Standards


Cell: +1.609.903.3360



On Mar 15, 2017, at 7:37 PM, Richard Barnes <> wrote:

I would note that "freshness" is but one aspect of a certificate that you need OCSP for.  The far more common use in the WebPKI is when the CA simply screws up.


In any case, to recap the experience from the Web PKI, the trade-off space has basically the following shape:

1. Do a live query [draft-ietf-stir-certificates-ocsp]

2. Make something with a short lifetime

2.a. Mandatory OCSP stapling

2.b. Short-lived certificates [draft-peterson-stir-certificates-shortlived]

The trade-off is basically between the sender/signer having to do queries (to refresh OCSP or get a new cert) and recipient/verifier having to do queries (to fetch OCSP).  (2.a) is a bad deal unless you have some legacy need to use OCSP; otherwise it's just bloat relative to (2.b).

If you ask web people, you're likely to get a pretty strong preference for (2), i.e., putting the burden on the sender, because (a) it's more predictable and (b) it's offline with respect to call time, and thus much less performance sensitive.  The web started out with (1) and it has turned out to be totally unworkable, because the CAs can't operate OCSP servers that are good enough to avoid seriously degrading the performance of browsing experience.

The main push-back we get from server operators about (2) is that it requires outbound connections from web servers -- load and downtime never come up as issues.  Outbound connections shouldn't be an issue for STIR signers, since they're likely to be making outbound connections all the time anyway.  Even if not, it's a simple firewall rule to write to let out connections to your CA.



On Wed, Mar 15, 2017 at 4:33 PM, Peterson, Jon <> wrote:


In reaction to the IESG review, and as well, to our own general sense that we're still not ready to mandate any particular direction, we ended up pulling the real-time status check of OCSP out of the last version of stir-certificates. Figuring out how we want to manage certificate freshness, especially in light of certificates assigned to telephone numbers, is probably the last bit about the core STIR work, before we go on to extensions and so forth, that we need to tackle.


I'd like to spend some meeting time talking about two approaches, as well as any better ideas anybody comes up with for this. The first is roughly what was in the stir-certificates document previously, which is now captured in:


The other is an approach based on short-lived certificates, which would likely rely on ACME or something similar. I've mocked up a discussion draft for that:


... though it is still fairly content-free at the moment. 


I think reviewing what we've done with stir-certs and these two approaches warrants some face-time discussion. Thoughts here on the list beforehand are welcome too.




Jon Peterson

Neustar, Inc.



stir mailing list


stir mailing list 



_______________________________________________ stir mailing list