Subject: [saag] Fwd: [POSH] PKIX Over Secure HTTP (POSH)

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 04 Jun 2013 17:29:03 -0600

FYI.

-------- Original Message --------
Subject: [POSH] PKIX Over Secure HTTP (POSH)
Date: Tue, 04 Jun 2013 17:24:15 -0600
From: Peter Saint-Andre <[email-masked]>
To: [email-masked]

Matt Miller and I have been working on a specification for "PKIX Over
Secure HTTP" (POSH), which aims to make it easier to ensure proper TLS
server identity checking in multi-tenanted environments (where it's
basically impossible right now):

https://datatracker.ietf.org/doc/draft-miller-posh/

As the abstract says:

   This document defines two methods that make it easier to deploy
   certificates for proper server identity checking in application
   protocols.  The first method enables a TLS client to obtain a TLS
   server's end-entity certificate over secure HTTP as an alternative to
   standard Public Key Infrastructure using X.509 (PKIX) and DNS-Based
   Authentication of Named Entities (DANE).  The second method enables a
   source domain to securely delegate an application to a derived domain
   using HTTPS redirects.

We love PKIX (really!), we love DNSSEC, and we love DANE (which solves
some of the same problems for some application protocols as POSH
does). However, we want a technology that can be deployed more quickly
than DANE in order to solve pressing operational security issues with
standard PKIX in multi-tenanted environments.

This effort emerged from the XMPP community, but we have heard from
folks working on other application technologies that it might be
useful for things like IMAP and SMTP, thus the more generalized
version of POSH that we published today (superseding
draft-miller-xmpp-posh-prooftype).

We are planning to hold a BoF on this topic in Berlin, but in the
meantime comments are very much welcome. Please post your feedback to
the new [email-masked] list:

https://www.ietf.org/mailman/listinfo/posh

Thanks!

Peter

_______________________________________________
posh mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/posh