Subject: [wpkops] 00 I-D on trust models

From: Tim Moses <[email-masked]>
Date: Tue, 4 Sep 2012 17:13:32 +0000

Colleagues - Here's a 00 I-D on trust models.

http://tools.ietf.org/html/draft-moses-webpki-trustmodel-00

Please take a moment to look it over and comment.  I need your help to correct and complete it.

Thanks a lot.  All the best.  Tim.

T: +1 613 270 3183

---

From: Adam Langley <[email-masked]>
Date: Tue, 4 Sep 2012 16:33:36 -0400

> Please take a moment to look it over and comment.  I need your help to

I'm afraid that, while I lovely use of ASCII-art, I find the document
very hard to understand. If I didn't already know what it was trying
to say, I don't believe that I'd have a hope of understanding it. I
feel that having two different labels in each box is a mistake, as are
the carnality indicators, at least as currently drawn. Some examples
may also help.

Cheers

AGL

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 04 Sep 2012 17:50:21 -0400

On 09/04/2012 04:33 PM, Adam Langley wrote:
> to say, I don't believe that I'd have a hope of understanding it.

while i think we need some kind of taxonomy/shared vocabulary like this
document is trying to introduce, I'm afraid i have to echo Adam's
sentiment here.  The terminology and the ascii artwork seem confusing
rather than enlightening.

There are also some curious inconsistencies in this document.  For
example, section 3.1 ("Client Application uses OS root store") says

  "[the certificate user software] may then apply additional
   checks, such as checking that the certificate subject's domain name
   matches that requested by the certificate user."

But surely that's also the case in section 2 ("Basic trust model") and
the other 3.x sections?

Also, section 3.8 ("The certificate user directly trusts a
certificate-holder certificate") says:

   Clearly, in this case, the user does not benefit from any of the
   assurances normally provided by the policy management authority, the
   root CA, or the issuing CA.

3.7 contains similar language, but nowhere else in the document are any
"assurances" mentioned.  What do users generally expect from these
assurances?  Perhaps such things should be mentioned specifically before
being referenced?

Arguably, the same section could also say "In this case, the user's
connections cannot be compromised by any flaws in the validation and
certification processes enacted by the policy management authority, the
root CA, or the issuing CA." i'm not sure one text is in any way more
correct than the other, but it seems odd to have just the one
perspective presented.

Regards,

	--dkg

---

From: Tim Moses <[email-masked]>
Date: Wed, 5 Sep 2012 13:16:12 +0000

Thanks Adam.  If the figures aren't adding anything, we might as well just delete them.  All the best.  Tim.

---

From: Leif Johansson <[email-masked]>
Date: Wed, 05 Sep 2012 17:37:05 +0200

On 09/04/2012 10:33 PM, Adam Langley wrote:
> I'm afraid that, while I lovely use of ASCII-art, I find the
> document very hard to understand. If I didn't already know what it
> was trying to say, I don't believe that I'd have a hope of
> understanding it. I feel that having two different labels in each
> box is a mistake, as are the carnality indicators, at least as
> currently drawn. Some examples may also help.
> 

+1