Re: [TLS] Interim notes and draft-ietf-tls-dnssec-chain-extension next steps

[Tom Ritter <[e-mail]>]

I was not at the interim, so this email comes without context of that
discussion. Apologies if this was exactly what the chairs didn't
want...

On Tue, 9 Oct 2018 at 00:10, Christopher Wood
<[e-mail]> wrote:
> - October 8 through October 19: Discuss the problem statement. In
> particular, if anyone feels the problem statement captured in the
> draft introduction [2,3] or in the above "facts" is incorrect,
> imprecise, or misleading, please say so, and say why (in a succinct
> fashion).

I agree with the facts presented in the email. I find the problem
statement in Section 2 of
https://tools.ietf.org/html/draft-ietf-tls-dnssec-chain-extension-07
to be imprecise.

Whether or not something is imprecise is often only discoverable in
hindsight, given disagreements about it. That seems to be the case
here.

Specifically, it does not state if the intent of the draft is to
enable a *server* to limit authentication of itself to this mechanism.
It only talks about enabling a client to authenticate the server.
Basically the draft doesn't say if it's supposed to specify a pinning
mechanism or not. Since it omits it, my assumption would be that it
_would_ not and _should_ not specify a pinning mechanism. (If it did
specify a pinning mechanism, then the draft is solving a problem not
explained in the introduction.)

-tom