Subject: [dane] Referring to the DANE protocol and DANE-denoted certificate associations

From: =JeffH <[email-masked]>
Date: Fri, 20 Apr 2012 15:34:41 -0700

> On Apr 20, 2012, at 10:50 AM, =JeffH wrote:
 >
 >> Various specs are going to have need to refer to the DANE protocol
 >> specification a well as describe the notion of domain names that map to
 >> TLSA records describing certificate associations.
 >>
 >> In working on such language in draft-ietf-websec-strict-transport-sec,
 >> here's the terms I'm using at this time and their (contextual) meaning..
 >>
 >>
 >> DANE protocol
 >>  The protocol specified in draft-ietf-dane-protocol (RFC# tbd).
 >
 > There is an issue here that we haven't dealt with, which is that "DANE
 > protocol" doesn't really make sense because we might be adding additional
 > protocols for certificate associations for things other than TLS.

Yep.  "DANE" is a working group name. But, I was working from the specification 
name per the present spec.

 > ...
 > Proposal for [-dane-protocol] spec:
 >
 > The protocol in this document can generally be referred to as the "TLSA
 > protocol".

So as a practical matter, if we wish to refer to this particular spec as 
defining the "TLSA protocol", then perhaps the spec title should reflect that 
such that the RFC Index is searchable for that "TLSA" term.

 > We use the term "usable certificate association" in section 4. For your
 > spec, how about:
 >
 >   trusted certificate association
 >     A certificate association specified in a TLSA record
 >     that is determined to be usable in the TLSA spec.
 >

In that case, I'd be inclined to just use "usable cert association" rather than 
redefine it with the qualifier "trusted" (ie, if that's not what the 
-dane-protocol spec defines).

Also, it would be helpful if the term "usable certificate association" is 
explicitly defined in a clearly referenceable manner in -dane-protocol.

This could be done by making that final para of section 4 a titled subsection, 
e.g..

   4.1 Usable Certificate Association

but since I notice that section 4 is entitled "Use of TLSA Records in TLS" it 
should perhaps be..

   4.1 Usable TLS Certificate Association

Or/and perhaps explicit definitions such as this could be explicitly added to 
section "1.4. Terminology".

And the HSTS spec should perhaps use "usable TLS certificate association".

HTH,

=JeffH

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 21 Apr 2012 13:38:38 -0700

On Apr 20, 2012, at 3:34 PM, =JeffH wrote:

> Yep.  "DANE" is a working group name. But, I was working from the specification name per the present spec.
> 
> > ...
> So as a practical matter, if we wish to refer to this particular spec as defining the "TLSA protocol", then perhaps the spec title should reflect that such that the RFC Index is searchable for that "TLSA" term.

The WG already decided against that (unfortunately).

> In that case, I'd be inclined to just use "usable cert association" rather than redefine it with the qualifier "trusted" (ie, if that's not what the -dane-protocol spec defines).
> 
> Also, it would be helpful if the term "usable certificate association" is explicitly defined in a clearly referenceable manner in -dane-protocol.
> 
> This could be done by making that final para of section 4 a titled subsection, e.g..
> 
> but since I notice that section 4 is entitled "Use of TLSA Records in TLS" it should perhaps be..
> 

I like the former.

> Or/and perhaps explicit definitions such as this could be explicitly added to section "1.4. Terminology".

The definition of what is "usable" goes on for many paragraphs, so that doesn't seem so great.

> And the HSTS spec should perhaps use "usable TLS certificate association".

Yes.

--Paul Hoffman

---

From: John Gilmore <[email-masked]>
Date: Sat, 21 Apr 2012 18:53:11 -0700

I tried bearding this lion several times, too.  It's painful to have a
spec that we have no short name for.  My latest suggestion is that we
call it the "DANE TLS" protocol.

I still find the whole "certificate association" undefined term puzzling.
Maybe somebody else can take a stab at defining it.  Or maybe the WG
really likes having undefined terms at the heart of its protocol.
A "certificate association" seems to be defined as "whatever is in a 
TLSA record" but to me that's rather circular.  I would prefer that we
just called it a TLSA record if that's all it's going to be.

	John

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 22 Apr 2012 07:29:08 -0700

> call it the "DANE TLS" protocol.

Just noting that this is not what you suggested the last time, I believe.

> I still find the whole "certificate association" undefined term puzzling.

In what way is it "undefined"?

> Maybe somebody else can take a stab at defining it.  

The draft says:

   A certificate association is formed from a piece of information
   identifying a certificate and the domain name where the data is
   found.  The combination of a trust anchor and a domain name can also
   be a certificate association.

> Or maybe the WG

The fact that you don't like the definition that is given in the draft says something about what you "really like"; it doesn't reflect anything about the WG.

> TLSA record" but to me that's rather circular.  

The definition above does not contain those terms, nor even that idea.

> I would prefer that we

So far, the WG has not agreed that that is all it is going to be. You can propose that, but it would be a new definition.

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Thu, 26 Apr 2012 12:48:36 -0400

> call it the "DANE TLS" protocol.

This sounds like a good option and makes things clearer.  Let's refer to it as this…

W

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>