From hannes.tschofenig@gmx.net Mon Oct 21 23:49:25 2013 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F83011E816D for ; Mon, 21 Oct 2013 23:49:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.625 X-Spam-Level: X-Spam-Status: No, score=-102.625 tagged_above=-999 required=5 tests=[AWL=-0.026, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kGeJdI0gs0O2 for ; Mon, 21 Oct 2013 23:49:21 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by ietfa.amsl.com (Postfix) with ESMTP id 03FA111E8477 for ; Mon, 21 Oct 2013 23:49:21 -0700 (PDT) Received: from [172.16.254.200] ([80.92.115.161]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0MMCSP-1VeFsD044L-0082B7 for ; Tue, 22 Oct 2013 08:49:20 +0200 Message-ID: <5266200B.7060501@gmx.net> Date: Tue, 22 Oct 2013 08:49:47 +0200 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.0 MIME-Version: 1.0 To: therightkey@ietf.org References: <52661FCE.6040209@gmx.net> In-Reply-To: <52661FCE.6040209@gmx.net> X-Forwarded-Message-Id: <52661FCE.6040209@gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:VpHugzJWj4pUTLx39TZWGWU3evgENDzz0VsNDUU3uOZI1O0TYO0 W+NoSUFiMjrSfIWVhJPSfScCFhVWsDdsMsyhLMbScqFw8EW3eD6KU7lp8MeffXxCdFwjrng mC1kuOQSLyMrg2sBropA2kaxP0EG+vVr+cFx7ycvBMasXbl8+BfLVVxbtmYocQC+DZcNPU2 4icPV8EFRJxwS6swBS9ng== Cc: hannes.tschofenig@gmx.net Subject: [therightkey] draft-tschofenig-iab-webpki-evolution-00 X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Oct 2013 06:49:25 -0000 Hi all, one item that predates the pervasive surveillance debate is the discussion about improving the public key infrastructure (but still has relevance in this discussion, see https://www.net-security.org/secworld.php?id=15579). Following the workshop at NIST earlier this year the IAB and ISOC have been reaching out to different players (and are still doing that) to continue the conversation. We have put together a first document that describes the different proposals (and as you can see the level of detail available for them and their maturity varies greately). Here is the writeup: http://tools.ietf.org/html/draft-tschofenig-iab-webpki-evolution-00 The analysis is still a bit weak and requires more work but the proposals are hopefully captured accurately. Let us know whether there is something missing. We hope that this could help to create move momentum behind certain proposals to get them accepted by the community and widely deployed. Ciao Hannes From trevp@trevp.net Tue Oct 22 09:39:32 2013 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53D5E11E828B for ; Tue, 22 Oct 2013 09:39:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.977 X-Spam-Level: X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iw3QI16HiKNX for ; Tue, 22 Oct 2013 09:39:24 -0700 (PDT) Received: from mail-wg0-f46.google.com (mail-wg0-f46.google.com [74.125.82.46]) by ietfa.amsl.com (Postfix) with ESMTP id 4550621F9E3A for ; Tue, 22 Oct 2013 09:39:13 -0700 (PDT) Received: by mail-wg0-f46.google.com with SMTP id m15so8047841wgh.13 for ; Tue, 22 Oct 2013 09:39:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=kkFU9rnCOCbhMT4atFpwah9k5X2bTUHnMl7teDxbDko=; b=m91db7UpjeDjvPHExWwS1G20JLVjQ8ldAf6NI863dsTBqAnlySlTR2nfuU+VcewNrZ +x2NBBIPDNbAsdzToj5DJPVN6fDosNc+VPY+uuDQZw8ZDLvlCY+rKA18+J4Hc3xbA2K+ FnXsBCv2xC1mGwnEtKwDEaj2JxpKF6Y2R4JFvFp/9+enlcjHRH8DutGYcxqMuRwJZFU+ sOW1az9asmO21qt62UcskZm5DPLLZ5TFuxQPLIUOZ+Cz1sbTS+sQed+jpSzNrQ0XQeCg SDeIdX1/C1lQ+7RDAgiC5h0f28nfNQ5JsRk4sOJ7MmkeEHYhHI8k4wCCpDvPAg4bTUF6 lsdg== X-Gm-Message-State: ALoCoQnepRF21l/I7g4pjx+DJdxWowul3ka+/ZCQR3daCZjqt4zTEhPopAOxmhI5hBqYmqtGS82C MIME-Version: 1.0 X-Received: by 10.180.9.139 with SMTP id z11mr15480354wia.22.1382459953315; Tue, 22 Oct 2013 09:39:13 -0700 (PDT) Received: by 10.216.61.13 with HTTP; Tue, 22 Oct 2013 09:39:12 -0700 (PDT) X-Originating-IP: [199.83.223.81] In-Reply-To: <5266200B.7060501@gmx.net> References: <52661FCE.6040209@gmx.net> <5266200B.7060501@gmx.net> Date: Tue, 22 Oct 2013 09:39:12 -0700 Message-ID: From: Trevor Perrin To: Hannes Tschofenig Content-Type: text/plain; charset=ISO-8859-1 Cc: "therightkey@ietf.org" Subject: Re: [therightkey] draft-tschofenig-iab-webpki-evolution-00 X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Oct 2013 16:39:32 -0000 Hi Hannes, Quick notes re TACK - A TACK-compliant HTTPS server will present *both* the TACK extension and an X.509 cert chain. We envision browsers performing both TACK *and* X.509 validation. The details of how the "TLS server key is signed with the TSK" are described in draft-02, section 3.2.1 (see "target_hash" and "signature" fields). Trevor On Mon, Oct 21, 2013 at 11:49 PM, Hannes Tschofenig wrote: > Hi all, > > one item that predates the pervasive surveillance debate is the > discussion about improving the public key infrastructure (but still has > relevance in this discussion, see > https://www.net-security.org/secworld.php?id=15579). > > Following the workshop at NIST earlier this year the IAB and ISOC have > been reaching out to different players (and are still doing that) to > continue the conversation. > > We have put together a first document that describes the different > proposals (and as you can see the level of detail available for them and > their maturity varies greately). Here is the writeup: > http://tools.ietf.org/html/draft-tschofenig-iab-webpki-evolution-00 > > The analysis is still a bit weak and requires more work but the > proposals are hopefully captured accurately. Let us know whether there > is something missing. > > We hope that this could help to create move momentum behind certain > proposals to get them accepted by the community and widely deployed. > > Ciao > Hannes > > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey