Re: [Tm-rid] IPv6 address encoding in commonName

[Michael Richardson <[e-mail]>]

Robert Moskowitz <[e-mail]> wrote:
    > Given the HHIT prefix as in the example above, the reverse DNS for the
    > HDA/RRA can be calculated (first attempt in
    > draft-moskowitz-hierarchical-hip, but I am revising it) and additional
    > information learned.

    > In raw HHIT mode, you have the device's HHIT and thus the /64 prefix. 
    > That gets you to services to learn the HI to validate sigs, for example
    > and see if the HHIT revocated and such.

via reverse DNS, or something else?

Do your intermediate CAs have HHIT in the DN, or something else?

    > In fact, I am leaning toward a simple DNS structure:

    > hda.rra.hhit.tld    PTR    foo.com

    > and foo.com has lots of SRV RR for all the various services it
    > provides.  Why go through the allusion of rDNS in this case?

    > In client x.509 cert mode the issuerName is the CN like above.  But
    > again, the subjectName is empty and the SAN is the client HHIT. Well
    > the client HHIT prefix MUST be the same as that in the issuerName, so
    > why bother with that, other than x.509 says there is an issuerName...

Yes, we can deal with empty Subject DN for EE, but not, as you said, for
intermediates.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [