Subject: [wpkops] FW: New Version Notification for draft-moses-webpki-trustmodel-01.txt

From: Tim Moses <[email-masked]>
Date: Sat, 15 Sep 2012 15:02:28 +0000

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Saturday, September 15, 2012 11:02 AM
To: Tim Moses
Subject: New Version Notification for draft-moses-webpki-trustmodel-01.txt

A new version of I-D, draft-moses-webpki-trustmodel-01.txt
has been successfully submitted by Tim Moses and posted to the IETF repository.

Filename:	 draft-moses-webpki-trustmodel
Revision:	 01
Title:		 Trust models of the Web PKI
Creation date:	 2012-09-15
WG ID:		 Individual Submission
Number of pages: 8
URL:             http://www.ietf.org/internet-drafts/draft-moses-webpki-trustmodel-01.txt
Status:          http://datatracker.ietf.org/doc/draft-moses-webpki-trustmodel
Htmlized:        http://tools.ietf.org/html/draft-moses-webpki-trustmodel-01
Diff:            http://www.ietf.org/rfcdiff?url2=draft-moses-webpki-trustmodel-01

Abstract:
   This is one of a set of drafts that document the operation of the Web
   PKI.  It describes common variants of the Web PKI trust model

The IETF Secretariat

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sat, 15 Sep 2012 11:50:30 -0400

> Filename:	 draft-moses-webpki-trustmodel

Thanks for the new version, Tim.  I think it's an improvement on the old
one.

However, in the new version, section 3.2 (Certificate using product uses
OS root store) still retains the following clause, which is absent in
both the "basic trust model" and the "trust model variants":

   It may then apply additional
   checks, such as checking that the certificate subject's domain name
   matches that requested by the certificate user.

I'm pretty sure these "additional checks" are critical to most
legitimate use cases on the web.  If i browse to site X and it presents
a valid certificate that's only valid or site Y, the browser should not
accept it.

So i really don't think you want the term "additional" here
("additional" makes it sound like those checks are unimportant).

And i also think this description of what sort of requested name-to-cert
validation (and other criteria, like looking for certain X.509v3
extensions?) should span the various defined trust models, rather than
being isolated to a single "variant".

	--dkg