Re: [TLS] WGLC for draft-ietf-tls-oob-pubkey-03.txt

[Paul Wouters <[e-mail]>]

On Thu, 26 Apr 2012, Simon Josefsson wrote:

> Major concerns:
>
> 1) Section 3.1 and 3.2 more or less duplicate section 3.1 and 3.2 of RFC
> 6091.  Wouldn't it be better to describe the RawPublicKey
> CertificateType alone, rather than duplicating the entire
> CertificateType extension?

I think you are right. This was originally done because it started as
a new TLS extension, and then also covered what has now been moved to
cached-objects.

> 2) The "Security Considerations" says that the main challenge with raw
> public keys over keys in X.509/OpenPGP is how to associate the public
> key with a specific entity.  However, I believe the problem is larger
> than that, and there is a similar challenge for several other forms of
> metadata about a public key.  It is not only the identity of a key that
> can have significant impact on system security.  Other kind of metadata
> (for example "do not use this public key after the year 2015") can be
> critical for secure deployments.  I suggest to add a final paragraph to
> discuss this.

Sounds reasonable. Will do.

> Minor concerns:

All fixed as per your suggestions.

Paul