Subject: [dane] Referring to the DANE protocol and DANE-denoted certificate associations

From: =JeffH <[email-masked]>
Date: Fri, 20 Apr 2012 10:50:21 -0700

Howdy,

Various specs are going to have need to refer to the DANE protocol 
specification a well as describe the notion of domain names that map to TLSA 
records describing certificate associations.

In working on such language in draft-ietf-websec-strict-transport-sec, here's 
the terms I'm using at this time and their (contextual) meaning..

DANE protocol
   The protocol specified in draft-ietf-dane-protocol (RFC# tbd).

trusted certificate association
   A certificate association specified in a TLSA record obtained via an
   error-free lookup in the Secure DNS.

Note that at this time, neither of the above precise terms are defined in 
draft-ietf-dane-protocol-19, although the title of the spec is essentially 
"DANE protocol", and the term "certificate association" (as-is, as well as 
further variously qualified) is used throughout the spec.

You can view this as a comment on draft-ietf-dane-protocol-19 if you like -- 
i.e., the spec could perhaps more explicitly provide guidance as to how it and 
its mechanism should be referred to.

HTH,

=JeffH

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 20 Apr 2012 13:57:28 -0700

On Apr 20, 2012, at 10:50 AM, =JeffH wrote:

> Various specs are going to have need to refer to the DANE protocol specification a well as describe the notion of domain names that map to TLSA records describing certificate associations.
> 
> In working on such language in draft-ietf-websec-strict-transport-sec, here's the terms I'm using at this time and their (contextual) meaning..
> 
> 
> DANE protocol

There is an issue here that we haven't dealt with, which is that "DANE protocol" doesn't really make sense because we might be adding additional protocols for certificate associations for things other than TLS. For your doc, you should be saying "TLSA protocol", not "DANE protocol" because HSTS is specific to TLS. (More below.)

>  error-free lookup in the Secure DNS.

We use the term "usable certificate association" in section 4. For your spec, how about:
trusted certificate association
  A certificate association specified in a TLSA record that
  is determined to be usable in the TLSA spec.

> Note that at this time, neither of the above precise terms are defined in draft-ietf-dane-protocol-19, although the title of the spec is essentially "DANE protocol", and the term "certificate association" (as-is, as well as further variously qualified) is used throughout the spec.
> 
> You can view this as a comment on draft-ietf-dane-protocol-19 if you like -- i.e., the spec could perhaps more explicitly provide guidance as to how it and its mechanism should be referred to.

Good point. Proposal for our spec:

The protocol in this document can generally be referred to as the "TLSA protocol".

Do others like this?

--Paul Hoffman