[TLS] OpenPGP Certs for TLS [was: Re: Summarizing identity change discussion so far]

[Daniel Kahn Gillmor <[e-mail]>]

On 12/17/2009 06:15 PM, Kyle Hamilton wrote:
> (Certificate type 0 is X.509/PKIX.  Certificate type 1 is OpenPGP --
> oh, but wait, we don't have anyone here to advocate the matching rules
> for its particular IANA assignment... Each type, 0 and 1, has
> different matching rules.  The rule for verifying the token that is
> presented MUST be defined, in TLS, as the rule defined by the document
> that defines the format of the token, or else the TLS WG is once again
> putting a policy decision into a technical specification, restricting
> the kinds of authentication which can be used.)

Actually, i'm interested in proposing some concrete matching rules for
certificate type 1 (OpenPGP) at some point, though i haven't seen any
attempts to formalize them yet in the context of TLS.

I don't think that this particular draft (covering TLS renegotiation) is
the place to do it, though.

But if folks want to talk about OpenPGP certs for TLS as part of another
conversation, i'm interested.  I might be taking over 5081bis from Nikos
Mavrogiannopoulos as well, and i'd really like feedback from the
knowledgeable and experienced people here here on it.  But i thought i'd
let the current situation get sorted out first (and do a bit more of the
background work i need to do) before moving that project up in visibility.

Just wanted to register that there actually *are* folks who are invested
in OpenPGP certs for TLS.

Btw, thanks to everyone for the thoughtful discussion here.  I don't
intend my sudden de-lurking as an interruption of the work at hand.

Regards,

	--dkg