From ietf@meetecho.com Thu Aug 1 02:07:04 2013 Return-Path: X-Original-To: posh@ietfa.amsl.com Delivered-To: posh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A41E21F9F52 for ; Thu, 1 Aug 2013 02:07:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.149 X-Spam-Level: X-Spam-Status: No, score=-0.149 tagged_above=-999 required=5 tests=[AWL=0.570, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MnQOLDrP4zaZ for ; Thu, 1 Aug 2013 02:07:00 -0700 (PDT) Received: from smtpdg6.aruba.it (smtpdg224.aruba.it [62.149.158.224]) by ietfa.amsl.com (Postfix) with ESMTP id CCA1421F84F9 for ; Thu, 1 Aug 2013 02:06:31 -0700 (PDT) Received: from dell-tcastaldi ([130.129.65.11]) by smtpcmd02.ad.aruba.it with bizsmtp id 7M6W1m01C0EaGCq01M6Xru; Thu, 01 Aug 2013 11:06:31 +0200 Date: Thu, 1 Aug 2013 11:06:28 +0200 (CEST) From: Meetecho Team To: posh@ietf.org Message-ID: <110945054.13.1375347988913.JavaMail.tcastaldi@dell-tcastaldi> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_12_1739254974.1375347988911" X-Mailman-Approved-At: Thu, 01 Aug 2013 02:18:25 -0700 Subject: [POSH] POSH session recording available X-BeenThere: posh@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Discussion about PKIX Over Secure HTTP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:07:04 -0000 ------=_Part_12_1739254974.1375347988911 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Dear all, the full recording (synchronized video, audio, slides and jabber room) of the POSH WG session at IETF 87 is available at the following URL: http://ietf87.conf.meetecho.com/index.php/Recorded_Sessions#POSH For the chair(s): please feel free to put the link to the recording in the minutes, if you think this might be useful. Cheers, the Meetecho Team This email has been automatically generated by The Meetecho Conferencing System ------=_Part_12_1739254974.1375347988911-- From stpeter@stpeter.im Thu Aug 15 12:40:18 2013 Return-Path: X-Original-To: posh@ietfa.amsl.com Delivered-To: posh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEBAF21F9D2E for ; Thu, 15 Aug 2013 12:40:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.234 X-Spam-Level: X-Spam-Status: No, score=-102.234 tagged_above=-999 required=5 tests=[AWL=0.365, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ih3kvgKmLuUE for ; Thu, 15 Aug 2013 12:40:14 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 9DE2021F9AA3 for ; Thu, 15 Aug 2013 12:40:14 -0700 (PDT) Received: from ergon.local (unknown [64.101.72.39]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 485EAE834E; Thu, 15 Aug 2013 13:43:17 -0600 (MDT) Message-ID: <520D2E9C.9010001@stpeter.im> Date: Thu, 15 Aug 2013 13:40:12 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: "" X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [POSH] POSH and EST X-BeenThere: posh@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Discussion about PKIX Over Secure HTTP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2013 19:40:19 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At the POSH BoF in Berlin, Dan Harkins asked why we couldn't just use EST: https://datatracker.ietf.org/doc/draft-ietf-pkix-est/ This puzzled me, since Matt Miller and I both reviewed EST and concluded that it wouldn't solve the secure delegation problem. But Dan was pretty adamant about it so I've taken another look. :-) The fundamental stumbling block for me is that (as far as I can see) EST provides a way for a PKIX client to obtain a certificate for itself (i.e., "certificate enrollment"), whereas in POSH we need a way for a TLS client to receive a hint about the PKIX certificate that will be presented by the TLS server during TLS negotiation within an application protocol such as IMAP or XMPP. Here is what I see as the goal and "happy path" process in each approach. (Note: Examples might be simplified.) First, let's consider EST... Goal: As the owner of example.com, obtain an end-entity certificate for, say, the domain im.example.com. Process (followed by EST client) 1. Discover the EST server for the relevant CA (say, "ca.example") 2. Send GET to https://ca.example/.well-known/est/cacerts to learn the trust anchor for the EST server 3. Receive a response from the EST server containing the root cert and any additional certs 4. Send request to https://ca.example/simpleenroll (including a PKCS#10 Certification Request) to obtain an end-entity certificate for im.example.com 5. Receive a response from the EST server containing an "application/pkcs7-mime" object 6. Happily install the end-entity certificate at my XMPP server Now let's consider POSH... Goal: As an end user of the im.example.com service, determine what end-entity certicate will be presented by the TLS server at that domain Process (followed by XMPP/TLS client) 1. Send GET to https://im.example.com/.well-known/posh._xmpp-client._tcp.json 2(a). Receive JSON Web Key set specifying the certificate to be presented by the im.example.com domain - -or- 2(b). Get redirected to a hosting provider for im.example.com, say https://hosting.example.net/.well-known/posh._xmpp-client._tcp.json (and repeat step 1 for this domain, eventually receiving a JWK set) 3. Connect to im.example.com over XMPP, initiate TLS negotiation via STARTTLS, check the PKIX certificate presented by the TLS server against the information in the JWK set, and if all is OK then proceed to do various IM things through the XMPP server at im.example.com As far as I can see, these scenarios are very different in terms of goals and process. I freely admit that I might be missing something that is specified in or implied by the EST spec, but right now I don't see what that might be. Enlightenment would be welcome. :-) Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSDS6cAAoJEOoGpJErxa2p6EUP/3WbW84D8sXDgrIFg6/puJDq H3G7fBm3LhDSxklP9R4ac0r3PfFRwD52kAjApwXSG/+35rvRbP9fUVbT/IIu+LuQ m165CBQbKXgWAZtXzpvHNHLLw2Snk9gpSudlyHzvuYC6widWq2D6NSa/MDgsm7Ge NBegQqIOGSiM9TOlhMw5tJtppkMZ7D3ehb12YEcqpCT1J7JxzudG1XaDU5o78YDl CRXCYcFP73g7Tijj1WonQFfn5NPTRbUSHkVmkDqQAtUG7ZNWamGK2RqNJHfULpAl uy60LZIjinalxbSa0vBB4cYw2G5lw4eh7J/kqJvQXG16ko0dfbv3lXCL5vPB07ge YF3QXiwiqORTkb/cfuutktakc4PbroTsHr5n8/yOBfBe9HXTCfWylllbBnVHjisQ DvalAcxRzggdMV3La4J3ISflfwfdEPDRXZhs0dZBOEICol1M2VHgvVc18HQ1R+NS gjRPR/JJIn48V79Dneff02w3Px6yZD+YXW7S9tWzUR4CKOHCY0icqRspbq6kYcPi gJ6C+mR7iXsdEH8ZzTVomlQPpocIHGNd0CBNXay5FnphTt6f9UOpXwWSLl4GHrUe 6XdgZ82tqlG0mdHWG6pHw4mnGc2xNrQxdt7vW02lV5A2EMHVcpEbxs3jJgiVACsF +KSVDLK8BCt8mIuWSdQF =srFd -----END PGP SIGNATURE----- From stpeter@stpeter.im Thu Aug 15 13:59:16 2013 Return-Path: X-Original-To: posh@ietfa.amsl.com Delivered-To: posh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EA0811E819E for ; Thu, 15 Aug 2013 13:59:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.325 X-Spam-Level: X-Spam-Status: No, score=-102.325 tagged_above=-999 required=5 tests=[AWL=0.274, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ghH8cv40-K-z for ; Thu, 15 Aug 2013 13:59:05 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 2769F21F8994 for ; Thu, 15 Aug 2013 13:58:43 -0700 (PDT) Received: from ergon.local (unknown [64.101.72.39]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 2BE11E834E; Thu, 15 Aug 2013 15:01:45 -0600 (MDT) Message-ID: <520D4100.4060606@stpeter.im> Date: Thu, 15 Aug 2013 14:58:40 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: "" X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [POSH] a POSH-ian play X-BeenThere: posh@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Discussion about PKIX Over Secure HTTP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2013 20:59:16 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here is a light-hearted attempt to better explain the need for something like POSH... ### A POSH-ian Play Dramatis Personae Alice, an employee of Company A Bob, an employee of Company B Company A Company B CA, a Certification Authority Host, a Hosting Provider ACT ONE: The Perils of PKI SCENE 1 - No Shirt, No Service HOST to CA: Hey, I need a certificate. CA: Sure thing, for which domain? HOST: It's company-a.com. CA: Great, I'll send an email to hostmaster@company-a.com. HOST: Um, actually, that won't work. CA: Why not? HOST: Well, I don't control that address. CA: No problem, just prove that you're Company A in some other way. HOST: Sorry, I can't do that. CA: Why not? HOST: Well, I'm just their hosting provider. CA: Sorry, then I can't give you a cert for company-a.com. HOST: That's a bummer. CA: But I can give you a cert for hosting.example.net. HOST: I already have one of those! CA: So why not just use it? HOST: I guess I'll have to, thanks. SCENE 2 - Trust Me! ALICE to COMPANY A: I'd like a secure Foo connection, please. HOST: Sure, here's my certificate. ALICE: Who are you?! HOST: I'm the hosting provider for company-a.com. ALICE: Yeah, right! HOST: No, really, you can trust me! ALICE: Forget it, you scammer. I'm out of here! SCENE 3 - Reassurance ALICE to COMPANY A: I had a scary experience today! COMPANY A: I'm sorry to hear it. What happened? ALICE: I tried to connect and this Host said they were you! COMPANY A: Which Host? ALICE: Here's the certificate they presented... COMPANY A: Oh, actually that's fine. ALICE: Really?? COMPANY A: Yes, we hired them to host our Foo service. ALICE: Oh, OK. So what should I do next time? COMPANY A: Just click "OK". ALICE: That doesn't seem very secure! COMPANY A: Well, check that the cert says "hosting.example.net". ALICE: OK, but only if you say so... SCENE 4 - Failed Communication ALICE to COMPANY A: I'd like a secure Foo connection, please. HOST: Sure, here's my certificate. ALICE: Hmm, this says you are hosting.example.net. HOST: Right, that's me. ALICE: Um, I'm still not really comfortable, but OK. HOST: Great, here's your secure connection. ALICE to HOST: I'd like to send a message to Bob, please. HOST: Coming right up! COMPANY A to COMPANY B: Here's a message for Bob. COMPANY B to COMPANY A: Hold on, let me verify your identity. HOST: Sure, here's my certificate. COMPANY B: Who are you?! HOST: I'm the hosting provider for company-a.com. COMPANY B: Yeah, right! HOST: No, really, you can trust me! COMPANY B: Forget it, you scammer. I'm out of here! HOST to ALICE: Sorry, I can't deliver your message. ALICE: Why not? HOST: Company B didn't believe that I'm the host for Company A. ALICE: See, I told you so! So how do I contact Bob? HOST: I suppose you could call him on the phone... ALICE: That kind of defeats the purpose of this Foo service, eh? HOST: No comment. ACT TWO: The Pleasures of POSH SCENE 1 - The Delegation Dance COMPANY A to HOST: This isn't working out. HOST: What do you mean? We get along great. COMPANY A: Alice can't talk to Bob. HOST: Yeah, I know. COMPANY A: What are you going to do about it? HOST: Well, we could try something new. COMPANY A: I'm all ears. HOST: Here, put this file on your webserver. COMPANY A: What's in the file? HOST: It tells Company B about the certificate for the Foo service. COMPANY A: Isn't this your certificate? HOST: Yes, but that means I don't need your private key. COMPANY A: That sounds good. I trust you, but not *that* much. HOST: Um, OK. COMPANY A: Where do I put the file? HOST: At https://company-a.com/.well-known/posh-foo.json COMPANY A: OK, I'll give it a try. HOST: Oh, and make sure it's served only over HTTPS! COMPANY A: Done. HOST: Thanks, let's see how this works... SCENE 2 - Success ALICE: https://company-a.com/.well-known/posh-foo.json please. COMPANY A: Here's the JSON Web Key set you requested. ALICE: Thanks! Now I'd like a secure Foo connection, please. HOST: Sure, here's my certificate. ALICE: Hey, that matches the JWK set. Cool! HOST: Yes, it's this fancy new POSH technology we're using. ALICE: It's posh indeed! You're very smart. HOST: Aw, shucks. ALICE to HOST: I'd like to send a message to Bob, please. HOST: Coming right up! COMPANY A to COMPANY B: Here's a message for Bob. COMPANY B: https://company-a.com/.well-known/posh-foo.json please. COMPANY A: Here's the JSON Web Key set you requested. COMPANY B: Thanks. I'd like a secure Foo connection, please. HOST: Sure, here's my certificate. COMPANY B: Great, that matches the JWK set I got at Company A. HOST: POSH in action. COMPANY B: Yep. You're good to go. I'll send that message to Bob. HOST: I appreciate it! COMPANY B to BOB: Here's a message from Alice. BOB: Excellent, I've been waiting for that. Here's my reply. COMPANY B to HOST: Please send this message to Alice. HOST to COMPANY B: Got it! I'll send that right along. HOST to ALICE: Here's a message from Bob. ALICE: Thanks. It seems that we have a happy ending after all. HOST: Thanks to POSH, you bet! THE END ### Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSDUD/AAoJEOoGpJErxa2p2EgP/js5f1DGdzREJ3prmJA8QIE0 7GArKlqTPsDduhzfdywEm1BqZWe2J/sCw0yHlvYX5ibaMmwOVyW9B9Bizd+NgMKB i01HKVaKx+rp4OOuyiGROw0047cpNNh/TEId4mbuz3tVksC1wyWxKFgfLHi64neb 979ci/LpD1/Knbrz2OWax5d+uYfPnXjb2heyfiU02P7eXQGGKDxD5p+E9QJOqS0h 8x3EvA8CpJ3+prwsXkqVYGpSvv7Ijf5UEF5IwkijMW6J3zQBndqlCouCNC/6Juro BC08cezG93oa11VOpX+929Pr2b1US098CLp4/DS9QPfdd+79uUS8xYA3TMRNiWUk ZD1JgwWbrFkBpip7Vb3xrpFkuG5EBLZOobXZx2g4vQivVu4nD1FBMi/KnfTLQK45 JBg+nFb/IAWZNU0sgWkiP5FlKk58CDh1Cw/KqT1REAPVJEj3vhAbG68PX5rroT5h jf7oEYut5lqHOZs67HnwGxKOrwnKVQXp8O6+Xa8psJzihU3frnlYhZbNv65MYbpJ y+PxwnaxDBjZmNJmmUM2Bnof3BaZgPZD5snOWOTXX9jWtGwyTV4SbPCtkdfaLl/l i8tj/JAYC/sxnFY2lG+xOUUi63dD8ALUeSFnm9rIl7jfSRiWwhJ7H/sWSefvdWvB UPd9VELBLabXdErxCrk+ =f8BX -----END PGP SIGNATURE----- From mcr@sandelman.ca Thu Aug 15 16:47:10 2013 Return-Path: X-Original-To: posh@ietfa.amsl.com Delivered-To: posh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30F7411E8176 for ; Thu, 15 Aug 2013 16:47:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NjIvktm1Z0A9 for ; Thu, 15 Aug 2013 16:47:09 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3::184]) by ietfa.amsl.com (Postfix) with ESMTP id 9C1AC21F9C6B for ; Thu, 15 Aug 2013 16:47:09 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 904F02018F; Thu, 15 Aug 2013 20:54:05 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 2DFE863AB6; Thu, 15 Aug 2013 19:45:34 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 181C263AB2; Thu, 15 Aug 2013 19:45:34 -0400 (EDT) From: Michael Richardson To: Peter Saint-Andre In-Reply-To: <520D4100.4060606@stpeter.im> References: <520D4100.4060606@stpeter.im> X-Mailer: MH-E 8.2; nmh 1.3-dev; GNU Emacs 23.4.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Sender: mcr@sandelman.ca Cc: "" Subject: Re: [POSH] a POSH-ian play X-BeenThere: posh@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Discussion about PKIX Over Secure HTTP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2013 23:47:10 -0000 --=-=-= Peter, thanks for that. I think it helps a lot for an important use case. > HOST: Here, put this file on your webserver. ... >HOST: At https://company-a.com/.well-known/posh-foo.json >COMPANY A: OK, I'll give it a try. >HOST: Oh, and make sure it's served only over HTTPS! But, I don't get this part, unless of course, hosting provider isn't the HTTPS hosting provider. I think that's important to mention. For the part: >ALICE to HOST: I'd like to send a message to Bob, please. >HOST: Coming right up! >COMPANY A to COMPANY B: Here's a message for Bob. >COMPANY B: https://company-a.com/.well-known/posh-foo.json please. >COMPANY A: Here's the JSON Web Key set you requested. >COMPANY B: Thanks. I'd like a secure Foo connection, please. But I think that it's wrong. It's not COMPANY A to COMPANY B, it's Hosting Provider A to Hosting Provider B. -- Michael Richardson , Sandelman Software Works --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQCVAwUBUg1oG4qHRg3pndX9AQK7BQP9HD+n5lR8B5/7MZFmCOYAw8/cLLcwcj46 UqiyatY6oHVNNgxOJ0m1sIECL0jxMRuFkofJNZlX+Rqv0xn0PX0A2sNG0O+9RDa8 1wpPfAweSHAagyFeiZVhEWy/d+zVOGm7KaQ4kircksKFaqsWAVgYvgu2l18TbqNC Abum7Dt8X6c= =hXNN -----END PGP SIGNATURE----- --=-=-=-- From mcr@sandelman.ca Thu Aug 15 16:53:19 2013 Return-Path: X-Original-To: posh@ietfa.amsl.com Delivered-To: posh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD90011E81BF for ; Thu, 15 Aug 2013 16:53:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iTS1nnUeiYZ2 for ; Thu, 15 Aug 2013 16:53:19 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3::184]) by ietfa.amsl.com (Postfix) with ESMTP id 2410E11E8176 for ; Thu, 15 Aug 2013 16:53:19 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id E76C020274; Thu, 15 Aug 2013 21:00:16 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 98C2263AB6; Thu, 15 Aug 2013 19:51:45 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 7C56563AB2; Thu, 15 Aug 2013 19:51:45 -0400 (EDT) From: Michael Richardson To: Peter Saint-Andre In-Reply-To: <520D4100.4060606@stpeter.im> References: <520D4100.4060606@stpeter.im> X-Mailer: MH-E 8.2; nmh 1.3-dev; GNU Emacs 23.4.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Sender: mcr@sandelman.ca Cc: "" Subject: Re: [POSH] a POSH-ian play meets the king of DANEmark. X-BeenThere: posh@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Discussion about PKIX Over Secure HTTP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2013 23:53:19 -0000 --=-=-= Now, to start a different thread: >SCENE 2 - Success INSERT stage direction, showing Alice upgrading her web browser, calling IT because it turns out she uses IE6 because company-A has IE6 only intranet, and IT logging in to her workstation and installing Chrome and/or Firefox. >ALICE: https://company-a.com/.well-known/posh-foo.json please. >COMPANY A: Here's the JSON Web Key set you requested. I don't see how this is any different than doing the same lookup in DNS with DANE. The play would go: HOST: Here, have your DNS provider put this RR in your zone. COMPANY A: What's in the record? HOST: It tells Company B about the certificate for the Foo service. COMPANY A: Isn't this your certificate? HOST: Yes, but that means I don't need your private key. COMPANY A: That sounds good. I trust you, but not *that* much. HOST: Um, OK. It still requires the web browser and/or some other HTTPS relying application (IM client, SIP/Skype, ...) to be upgraded. I hear all sorts of FUD about how the "infrastructure" isn't ready, yet I don't buy that. What's keeping an IM client author from having enough of a recursive (validating if you like) name server library? Recurse from 8.8.8.8 as fallback if you have to. While I buy that the hosting providers have an incentive to make things work, and upgrading their software to do something useful is in their interest, I don't see why, given that they are clueful hosting providers, they can't use the specification we already have. -- Michael Richardson , Sandelman Software Works --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQCVAwUBUg1pj4qHRg3pndX9AQKtOAQAnsNA5jKsKxGlEEMe5P26kAAdfT75f+nU Imr1rFViGi9tp4etqhfKrlwud3QvgXoHBNoM2V2GcoHl0FKZ66CfX8W7TfTT/0QO 8jfBOl8Sj5xdIOwgZkTqYk6MtrNkotUrbidek58VOYOtY/mRNSdElqxQdKcr84Dx RqoZSlYca5k= =Udf8 -----END PGP SIGNATURE----- --=-=-=--