Re: [therightkey] Defining CT-for-PKIX and CT-for-DNSSEC

Shumon Huque <shuque@upenn.edu> Sat, 17 November 2012 18:18 UTC

Date: Sat, 17 Nov 2012 13:18:39 -0500
From: Shumon Huque <shuque@upenn.edu>
To: Paul Hoffman <paul.hoffman@vpnc.org>
Message-ID: <20121117181839.GA25913@isc.upenn.edu>
References: <2B12532F-90DE-4265-9EDB-38F49B5CA951@vpnc.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <2B12532F-90DE-4265-9EDB-38F49B5CA951@vpnc.org>
Organization: University of Pennsylvania
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: "therightkey@ietf.org" <therightkey@ietf.org>
Subject: Re: [therightkey] Defining CT-for-PKIX and CT-for-DNSSEC
Precedence: list

On Sat, Nov 17, 2012 at 08:01:10AM -0800, Paul Hoffman wrote:
> CT-for-PKIX helps a web site administrator determine if a trusted CA ever issued a certificate that should not have been issued.  
> 
> CT-for-DNSSEC helps a DNS zone administrator determine whether a DNS server in the hierarchy above the leaf zone ever included a DS record that should not have been included.
> 
> It would be good to have agreement on the above; feel free to offer changes and see if the authors agree. Then we can talk about the relationship between the two.
> 

Sounds reasonable to me.

Does "CT" need to be renamed for DNSSEC? Since we're talking about 
transparency of delegation records/keys and not X.509 certificates. 
If C means "certification" in the general sense, then I suppose it
might still be applicable since a (signed) DS record certifies the
authenticity of the secure entry point key in a subordinate zone.

-- 
Shumon Huque
University of Pennsylvania.

[therightkey] Defining CT-for-PKIX and CT-for-DNS… Paul Hoffman
Re: [therightkey] Defining CT-for-PKIX and CT-for… Shumon Huque
Re: [therightkey] Defining CT-for-PKIX and CT-for… Richard L. Barnes
Re: [therightkey] Defining CT-for-PKIX and CT-for… Paul Hoffman
Re: [therightkey] Defining CT-for-PKIX and CT-for… Carl Wallace
Re: [therightkey] Defining CT-for-PKIX and CT-for… Paul Wouters
Re: [therightkey] Defining CT-for-PKIX and CT-for… Paul Hoffman
Re: [therightkey] Defining CT-for-PKIX and CT-for… Carl Wallace
Re: [therightkey] Defining CT-for-PKIX and CT-for… Paul Wouters
Re: [therightkey] Defining CT-for-PKIX and CT-for… Carl Wallace
Re: [therightkey] Defining CT-for-PKIX and CT-for… Ben Laurie
Re: [therightkey] Defining CT-for-PKIX and CT-for… Ben Laurie
Re: [therightkey] Defining CT-for-PKIX and CT-for… Carl Wallace
Re: [therightkey] Defining CT-for-PKIX and CT-for… Ben Laurie
Re: [therightkey] Defining CT-for-PKIX and CT-for… Carl Wallace
Re: [therightkey] Defining CT-for-PKIX and CT-for… Ben Laurie
Re: [therightkey] Defining CT-for-PKIX and CT-for… Tom Ritter
Re: [therightkey] Defining CT-for-PKIX and CT-for… Ben Laurie