Subject: [Ietf-krb-wg] Fwd: New Version Notification for draft-hotz-kx509-02

From: "Henry B. Hotz" <[email-masked]>
Date: Wed, 6 Apr 2011 14:05:00 -0700

This is an individual submission, but I'm treating this as a "last call" for comments before I forward it up the chain.  I think I've addressed all the issues I can without making it incompatible with the deployed base.  The remaining issues are in Appendix C.  (Yes, I intend to start work on an incompatible upgrade once this draft has gotten published.)

Changes from the Previous Draft:

1.  The retry behavior was made slightly less specific.

2.  The traditionally used SAN extensions were moved to a new appendix, leaving only the id-pkinit-san as the RECOMMENDED SAN.

3.  The absolute prohibition against digital signatures in the Security Considerations section was relaxed since there are legitimate situations where a signature based on the KX509
certificate is still useful.  (E.g. integrity protection where the actual signing identity is not important.)

4.  Reference to TAGPMA in the abstract was replaced with a reference to its parent, the International Grid Trust Federation, and more detailed informative references were expanded in the Introduction.

5.  Assorted other wording changes were made for clarity, but are not believed to have changed the meaning.

Begin forwarded message:

> From: IETF I-D Submission Tool <[email-masked]>
> Date: April 6, 2011 1:41:59 PM PDT
> To: "Hotz, Henry B (173H)" <[email-masked]>
> Subject: New Version Notification for draft-hotz-kx509-02 
> 
> 
> A new version of I-D, draft-hotz-kx509-02.txt has been successfully submitted by Henry Hotz and posted to the IETF repository.
> 
> Filename:	 draft-hotz-kx509
> Revision:	 02
> Title:		 KX509 Kerberized Certificate Issuance Protocol
> Creation_date:	 2011-04-06
> WG ID:		 Independent Submission
> Number_of_pages: 11
> 
> Abstract:
> This rfc describes a protocol, called kx509, for using Kerberos
> tickets to acquire X.509 certificates.
> 
> While not (previously) standardized, this protocol is already in use
> at several large organizations, and certificates issued with this
> protocol are recognized by the International Grid Trust Federation.
> 
> 
> 
> The IETF Secretariat.

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg