Subject: [dane] Opening Issue #35 - Behavior for a supported algorithm that is not considered "strong" by the client.

From: Warren Kumari <[email-masked]>
Date: Sun, 8 Jan 2012 20:53:53 -0500

Hi all,

This will make it 3 open issues being discussed -- http://trac.tools.ietf.org/wg/dane/trac/ticket/35

I think that we are close to knowing what we want to do here (and the questions don't seem particularly controversial) so I am asking for your help and co-operation to try get this (final) question put to bed…

Lets see if we can stay on topic and work together to come to consensus…

Planning on calling this on Jan 23rd.

Thanks,

W

---
Don't be impressed with unintelligible stuff said condescendingly .
    -- Radia Perlman.

Warren Kumari
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 8 Jan 2012 18:00:33 -0800

At the end of section 4.4, we currently say:
   If a certificate association contains a certificate usage, selector,
   or matching type that is not understood by the TLS client, that
   certificate association MUST be marked as unusable.  If the
   comparison data for a certificate is malformed, the certificate
   association MUST be marked as unusable.

I propose that we add:
   If a certificate association contains a matching type or certificate
   for association that uses a cryptographic algorithm that is
   considered too weak for the TLS client's policy, the certificate
   association MUST be marked as unusable.

--Paul Hoffman

---

From: Olafur Gudmundsson <[email-masked]>
Date: Mon, 09 Jan 2012 11:10:10 -0500

>     association MUST be marked as unusable.
+1 In general to the text, but can we convert this to a list for 
readability?

Something like: (rough draft)
If a certificate association contains one or more of the following 
conditions:
	- certification usage, select or machining type that is not understood
	- uses a cryptographic algorithm considered too weak by policy
	- comparison data for the certificate is malformed
the client MUST mark that certificate association as unusable.

	Olafur

	Olafur

---

From: Ondřej Surý <[email-masked]>
Date: Tue, 10 Jan 2012 15:59:18 +0100

>>    association MUST be marked as unusable.

+1 here

>> --Paul Hoffman
>> 
> +1 In general to the text, but can we convert this to a list for readability?
> 
> If a certificate association contains one or more of the following conditions:

Also +1 here

O.
--
 Ondřej Surý
 vedoucí výzkumu/Head of R&D department
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Warren Kumari <[email-masked]>
Date: Tue, 10 Jan 2012 12:03:52 -0500

[ No hats ] 

>>>   association MUST be marked as unusable.

+1.

>> the client MUST mark that certificate association as unusable.

+0 (I don't care either way -- I slightly prefer the text as provided, but not enough to count.)

W

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Warren Kumari <[email-masked]>
Date: Mon, 23 Jan 2012 17:14:57 -0500

Hi all,

I am calling consensus on this item.

The authors are requested to add text similar to what was proposed below, but to please try and word the conditions as a list (as suggested by Olafur) to aid readability.

Thank you all for making this consensus call easy :-P
W