IETF Logo Mail Archive

Re: [TLS] 2nd WGLC for Delegated Credentials for TLS

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Wed, 01 July 2020 15:09 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C33353A0F21 for <tls@ietfa.amsl.com>; Wed, 1 Jul 2020 08:09:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=dEVXRPd3; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=dEVXRPd3
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1c5FL9b5LDe1 for <tls@ietfa.amsl.com>; Wed, 1 Jul 2020 08:09:36 -0700 (PDT)
Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60061.outbound.protection.outlook.com [40.107.6.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 920B03A0F20 for <tls@ietf.org>; Wed, 1 Jul 2020 08:09:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zKXXx7GmEASEPeQeLu480jzls/75qi0p9j8wvdcImsE=; b=dEVXRPd3BS+Pb/+I1xqXXhpct47TUKkFXwl8rYhPpR5EUiqsuDfON/kr3hIHtjq4DVfO76g9pzPdQeC8FZvFBsjgTDzflvVZvqmZt4x2zkXBSprngX/XrZHPKfH9DtzEoDqwsWlwv2eEfDbLh3gerqdKSk7O8Rjq722MlFmSctQ=
Received: from MR2P264CA0036.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500::24) by DB6PR0801MB1847.eurprd08.prod.outlook.com (2603:10a6:4:3c::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3131.23; Wed, 1 Jul 2020 15:09:33 +0000
Received: from VE1EUR03FT043.eop-EUR03.prod.protection.outlook.com (2603:10a6:500:0:cafe::67) by MR2P264CA0036.outlook.office365.com (2603:10a6:500::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3153.22 via Frontend Transport; Wed, 1 Jul 2020 15:09:32 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT043.mail.protection.outlook.com (10.152.19.122) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3131.20 via Frontend Transport; Wed, 1 Jul 2020 15:09:32 +0000
Received: ("Tessian outbound e44de778b77e:v62"); Wed, 01 Jul 2020 15:09:32 +0000
X-CR-MTA-TID: 64aa7808
Received: from dbd5a4c138ff.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 61021E9B-A7EA-452B-B092-21A4D0FAF49F.1; Wed, 01 Jul 2020 15:09:27 +0000
Received: from EUR03-VE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id dbd5a4c138ff.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 01 Jul 2020 15:09:27 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=f3bBxwj/jfIgg7xf/PdACAA7lqNh53rMOI4EFhw7KS0eib0f1zcoP+6+1LBspp5twXw+q1FbpCdXXRmdF3cVrVsZoffTBPGavDC69wczilsApl9OstdC6K1tDWHJWtVzgKUmfCp3Dss36gfhP/iPTrzBm/B9T3iEYYzthzyHL0BxjnI/aqQezC3w7M2ww3dpa87YwyuYBwMXtyRyGp3eQ5Lr/yfTBACHdSpJPnvQbNhfwvydGCOWpscfHHETJtc9yg2GZHj/L1oeRuo0EHnU3fhJv1FOkJL3VTz8P1pxSH422GSi0sxh3emWWdwsLywpqFh7f7QWqKVvcsqLpY6QRw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zKXXx7GmEASEPeQeLu480jzls/75qi0p9j8wvdcImsE=; b=jrCgGpNmXqifJuEfpwnec/d4nZHg5na+8E1ZbRkfKjkV4lXYoVgwxyM6VcYyN+U1OvdqYiE9ewc/jfYwK40T4SWdhXTOq4DM+OpdG5v8gFaAkH8y7HHUSSuZGb0HceVJXw+9PFnIH33Ucdlfd5LdttZwNfajqDZMVpd9y86+Q46RRV9e437WUuJnDSK/kkF+ElwYBXO4R0elAyGFatfo/y1KLpCH6yBP87jx/ceKMCGePe3VEdMt2N5b5ntGu07K4oPERSp4wMJthpYSWKzU16K1RXN14QrFZvE7znEtk80B4HIieMyBORCT8cXxvmhPawW/1MUlKenOvagZHv6b8A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zKXXx7GmEASEPeQeLu480jzls/75qi0p9j8wvdcImsE=; b=dEVXRPd3BS+Pb/+I1xqXXhpct47TUKkFXwl8rYhPpR5EUiqsuDfON/kr3hIHtjq4DVfO76g9pzPdQeC8FZvFBsjgTDzflvVZvqmZt4x2zkXBSprngX/XrZHPKfH9DtzEoDqwsWlwv2eEfDbLh3gerqdKSk7O8Rjq722MlFmSctQ=
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (2603:10a6:208:106::13) by AM0PR08MB5524.eurprd08.prod.outlook.com (2603:10a6:208:181::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3153.22; Wed, 1 Jul 2020 15:09:25 +0000
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::39f5:e4d9:51ff:eae]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::39f5:e4d9:51ff:eae%7]) with mapi id 15.20.3131.030; Wed, 1 Jul 2020 15:09:25 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Joseph Salowey <joe@salowey.net>, "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: [TLS] 2nd WGLC for Delegated Credentials for TLS
Thread-Index: AQHWTi5icKe0L+OVmUmqcb3z5zqCaajy1BWw
Date: Wed, 01 Jul 2020 15:09:25 +0000
Message-ID: <AM0PR08MB37162AD05CC8FFA2325218D1FA6C0@AM0PR08MB3716.eurprd08.prod.outlook.com>
References: <CAOgPGoB3LDZ2uMJkMyDxMbbWy6yScYuURVB7GqTiwVS0f2UkTw@mail.gmail.com>
In-Reply-To: <CAOgPGoB3LDZ2uMJkMyDxMbbWy6yScYuURVB7GqTiwVS0f2UkTw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ts-tracking-id: 121e881d-9fd7-4087-8a4a-7a594f0b8858.1
x-checkrecipientchecked: true
Authentication-Results-Original: salowey.net; dkim=none (message not signed) header.d=none;salowey.net; dmarc=none action=none header.from=arm.com;
x-originating-ip: [80.92.121.249]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 034a417e-642e-4e5a-fa7e-08d81dd0c271
x-ms-traffictypediagnostic: AM0PR08MB5524:|DB6PR0801MB1847:
X-Microsoft-Antispam-PRVS: <DB6PR0801MB184728E5A1EE653EC6B04009FA6C0@DB6PR0801MB1847.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000;
x-forefront-prvs: 04519BA941
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: v7Ob7ftJtl6k5JtZQhgx2g4dCeGusgeqRr3ULR7oJQCAyKy61E244yOWvDsshRjd/y54KKOkmJR4QxasBWoJWzboOqTsH/tZVe+mc4tkm/QQCAxZyuGJJCPUVH4xK5K8R/BxWalzb1t5S16fz836wOl16so4s2z8TFmrVoDLwbBK5G3hk9cLzKJq60WX6zV06pAOFL39W2I8bSEKFifrvA5NX4f0dR/aRDh/Yh2bu0QLsKo2RfSuRG8iScz0cdNQxglyeGU6yu7+NrhJR6UDGPYRJjKhJiw6knEPAr91mfvFfqBUN0W+biJh6jE/yKK4w1Wn2nskuqLANG43r+GBjyBGndBHRq7JSHnH0Gi5VbatFJAsJyo9Bvgypaxhw8bX3+NtpxwWmKd/CSqMGRGrBywk0oRv2A6oLt1OWoJjCCYxEKDjMvyKH8GK8rwMFoEc
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3716.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(346002)(39860400002)(376002)(136003)(396003)(8676002)(26005)(53546011)(86362001)(33656002)(5660300002)(2906002)(71200400001)(166002)(83380400001)(186003)(8936002)(64756008)(66556008)(66476007)(52536014)(9686003)(55016002)(316002)(110136005)(478600001)(6506007)(966005)(66446008)(66946007)(76116006)(7696005)(491001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: y9hRR/fJ85vjXpAw1r8S2tSRrQ7ehd6gUqXBOuOB7V+e3+q/HuF+VuAZKsj+WOpNxW3f5kjmRkQWl4jltvoa5+JAwOy912FcL3z39EQWb4FgIAiTJSjsqQ3nBjEWmC2IO4Yy0QWs843tWOvU/qDlo6tuQ9ulYbJgyPT3elKcDsvxM7xQNkeZmquCQmBHCU77PW4LCgv+f1A3yefobeBH1aqyZ+MoFSwN9C7l29UZ+6b0Yfdee5VGdLb1rCxm/GFRxx3c5Du1dkPZ+AHBrNgWq5v7HOlyg783n1QYfWRPBahltLSlLOAryex9YBxPZoaKjuLnbpx6glMKnK26+gmiVRwKnwlIX9fzEpTcYHQgX4zgRUj4k8Qx5iOQoZtaf8VY83YufJUcESD/1AaUB2oKYmW3M5sssGf+O8cjAkjtP347SOypkX4CmjK/OOLMnbAaZdu7ILl5SPIBbYMsq7MPByyQQXhKz/MDH1zoODgXt5Qxh9xYAUEQ8ZY5n4ccXjWj
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_AM0PR08MB37162AD05CC8FFA2325218D1FA6C0AM0PR08MB3716eurp_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB5524
Original-Authentication-Results: salowey.net; dkim=none (message not signed) header.d=none;salowey.net; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT043.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(376002)(396003)(346002)(46966005)(70586007)(52536014)(110136005)(5660300002)(966005)(8936002)(6506007)(53546011)(336012)(33964004)(55016002)(26005)(8676002)(2906002)(33656002)(70206006)(186003)(478600001)(9686003)(7696005)(47076004)(86362001)(81166007)(83380400001)(356005)(82310400002)(36906005)(82740400003)(166002)(316002)(491001); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: caf2e0c4-e886-4475-bec2-08d81dd0be82
X-Forefront-PRVS: 04519BA941
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: YxYQqnyS46TqcwhXF23INY9UuFkzF5fhYaFjSGZRG9rmP4aEmQHRFSp3+wBOFjYPJE7dTaYa/sPoVxnrudOgGhWuu9OdICbEVGJUkrbcJO7XDwaZRiI7ah7hSGUMBDKFWoumBMviXIALEXygVVRLgjaY1jYMd95odTlqpaZ3wMgiyG4PCkYOuPfMBrb+GDfLnmOkPaLsL5YF2jlg0r3Bcn1jgzL66xotiScrLXcKg92kQlx6cHtrZojSGzqXjejeZz8aj8rQDcz19biDvUmrsS8fMhDZMcy4T9Y2nZTssvBZTXPXvAExblpK6USX+fQYL77Q/MkrNrSTLHyE/tSr735447k6WsLHmoXHBUHHmn1joQSW0NjfLfijU41EAu37ziOXHFlI6QwVRB7ofzGqRvBaC7fQRI/meqGUcDOHgAa8j8Xk9Y+Boky+Gt+cbb3jZvDlZQK+2aTRmb+KOqHqBD+ENd3CG19R1hlyhXKKTpgIyuc2xHaXgTWEGIydO3A1
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jul 2020 15:09:32.4128 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 034a417e-642e-4e5a-fa7e-08d81dd0c271
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: VE1EUR03FT043.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1847
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/rLZK_C4Tl-KFELwmBwKpQZWUkrU>
Subject: Re: [TLS] 2nd WGLC for Delegated Credentials for TLS
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Jul 2020 15:09:39 -0000

Hi Joe, Hi draft authors,

I reviewed draft-ietf-tls-subcerts-09 and the document is well written and easy to understand.

I have only a minor remark regarding the validity time of the delegated credential.

In Section 3 you say
"
   In
   the absence of an application profile standard specifying otherwise,
   the maximum validity period is set to 7 days.  Peers MUST NOT issue
   credentials with a validity period longer than the maximum validity
   period.
"

In Section 4 you say the following about the validity time. "This MUST NOT exceed 7 days."

I wonder whether it makes sense to just copy the text from Section 3 to Section 4 have it read the same way.
Having the flexibility to extend this maximum validity time via profiles may turn out to be useful, as Section 3 already states.

The use of a new X.509 extension is unfortunate because tools used for creating certificates are somewhat behind supporting various extensions.
We ran into this issue for use with device certificates in IoT deployments.

I guess there is nothing to do about this other than trying to add support of this extension in popular tools.
Any plans to add support for this extension to the OpenSSL command line tool to create certificates?

Ciao
Hannes

From: TLS <tls-bounces@ietf.org> On Behalf Of Joseph Salowey
Sent: Monday, June 29, 2020 5:59 PM
To: <tls@ietf.org> <tls@ietf.org>
Subject: [TLS] 2nd WGLC for Delegated Credentials for TLS

This is the second working group last call for Delegated Credentials for TLS.  The latest draft can be found here: https://tools.ietf.org/html/draft-ietf-tls-subcerts-09.  There have been 2 revisions since the last review.  Draft 8 contains changes that were not committed in time for draft 7 and draft 9 contains revisions from the previous WGLC.  Links to the Diffs between the draft 9 and draft 7 can be found at the end of this message.   Please focus your review on the changes between draft 7 and draft 9.  Please send your comments to the list by July 13, 2020.

Thanks,

Sean and Joe

[Inline Diff] https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-tls-subcerts-09.txt&url1=draft-ietf-tls-subcerts-07.txt
[Side-by-side Diff] https://tools.ietf.org/rfcdiff?url2=draft-ietf-tls-subcerts-09.txt&url1=draft-ietf-tls-subcerts-07.txt

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.23.0 | Report a Bug | By Email