Re: [TLS] Consensus call for certificate URL extension

[Simon Josefsson <simon at josefsson.org>]

If the assumption in (B), that there are no known deployments of this
extension, is correct, my preference is to deprecate the extension,
without creating a new extension with different properties.

The way I am reading the replies so far imply that few if anyone really
needs this extension.  If that is the case, I don't see why we need to
spend time on it.

/Simon

"Joseph Salowey (jsalowey)" <jsalowey at cisco.com> writes:

> We need to close this open issue.  I think there are two basic options
> that address the security issues that have been raised:
>
> A) Deprecate the current extension and create a similar new extension
> with the hash mandatory.
>
> B) Make the hash mandatory in the current extension.  This should not
> cause deployment problems because there are no known deployments that
> make the hash optional.
>
> In either case, we can include hash agility as described in
> http://trac.tools.ietf.org/wg/tls/trac/ticket/46. If there is support in
> the working group for the use case where the certificate is updated
> offline then we can possibly work on a new extension in a new document
> that incorporates ideas expressed on the list.
>
> Please express you preference on the list for one of these options by
> 10/6/2008.
>
> Thanks,
>
> Joe
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls