Subject: Re: [Ietf-krb-wg] krb5starttls SAN-vs-EKU

From: Simon Josefsson <[email-masked]>
Date: Thu, 03 Dec 2009 12:11:56 +0100

Jeffrey Hutzelman <[email-masked]> writes:

> I don't see a consensus on this question; in fact, the only people
> involved in the discussion to date have been Simon, Nico, and myself.
> So long as the situation is that Simon takes one position, I and one
> other participant take another, and no one else speaks up, then I am
> unwilling to declare consensus, rough or otherwise.

It hasn't been my intention to take one position.  What I have been
looking for (repeatedly) has been concrete edit requests to reflect your
or Nico's proposal, as my perception has been that your proposals has
slightly changed during each discussion cycle and/or that I were never
able to understand it well enough to convert it into changes to the
document.

If you send me proposed changes to the document, I'll either incorporate
it directly if I agree with it or we can have the WG decide between the
two (or three?) variants.

I outlined my requirements on the naming issue earlier, but to
re-iterate I want

   1) administrators to have the ability to decide whether they want to
      let the PKINIT server cert be usable as a KRB5STARTTLS server cert
      or not, and vice versa, and

   2) not have a normative reference on PKINIT but instead cut'n'paste
      any SAN/EKU definitions, and

   3) whatever solution should be in line with RFC 5280 practices, and

   4) preferably the least complex solution that meets all requirements.

What are your requirements?  As far as I have understood, our
requirements are not mutually exclusive.

Other than those requirements, I don't care strongly how naming is
handled.  What's in the document is simply the first solution with the
least complexity that I could find that meets my requirements.

If this matter is resolved, what is the actual remaining reason to not
publish as proposed standard?

/Simon
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg