Re: [TLS] OCSP must staple

[Michael StJohns <[e-mail]>]

Hi -

The note by Brian Smith made me take a second look at 
http://datatracker.ietf.org/doc/draft-hallambaker-tlsfeature/. From the 
list chatter, I thought it was pretty much a standard CA extension.  I 
didn't realize that PHB had defined it as a transitive (i.e. if the CA 
has it, then it applies all the way down the chain) extension, rather 
than just a simple one-off application.

Given the above, I would reject the document and suggest instead that 
this use the CertificatePolicies extension.

Two ways of doing this:

First:

1) Define a policy OID for each TLS feature - the set is pretty small 
right now and I don't see it growing all that much.  This is probably 
the right approach and doesn't require anything more than a description 
of the OID and the related policy processing.

or Second

1) Define a policy OID for TLS Features
2) Define a PolicyQualifier OID for a FeatureIds qualifier
3) Define "FeatureIds ::= SEQUENCE of TlsFeatures"
4) Define "TlsFeatures ::= INTEGER { feature1 (1), feature2(2), ...}

This is more flexible, but seems to violate the spirit of RFC5280, 
section 4.2.1.4 - the "RECOMMENDS" items.

Doing it one of the above ways doesn't require modification to the cert 
path building logic (which isn't fully specified in the draft and should 
be).  The first also - mostly - doesn't require changes to code that 
build certificates which means it could enter production on the cert 
side much quicker.

Mike



On 6/5/2014 8:59 AM, Stephen Farrell wrote:
> Hiya,
>
> On 05/06/14 13:40, Phillip Hallam-Baker wrote:
>> By which I simply mean, lets make get people to actually read that
>> particular draft rather than start a cabal. So if we give folks a week
>> and then we can go forward with the document shepherd?
> Sure works for me. Can you try recruit a shepherd?
>
> I'll do an AD review in any case before I start IETF LC and will
> post a copy of that here. If other folks have comments I guess
> send those here or to PHB and me. I'd be happy to get a couple
> of mails saying "read it, its ready" after Phill's done his
> tweaks as well btw.
>
> Cheers,
> S.
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>