Re: New Issue Of The ITrace Document

Tom Taylor wrote:
> 
> 9. From the thread "Suggestions for changes to draft-ietf-itrace-03.txt", point 8
> (XML page for public key disclosure): reference to XML page modified to point to
> draft-ietf-pkix-certstore-http-04.txt, which talks about retrieving certificates
> with HTTP GETs.  We can change this back if something significant comes out of Don
> Eastlake's presentation at the meeting.  

After reading the certstore-http draft, it seems that it is targeted
at solving the problem of "I know the issuer and the cert ID. How do
I find the certificate"?  In my opinion, this is not the case in 
ITRACE.  We have a HTTP URL that points somewhere. We expect to
receive a raw certificate when we retreive that URL.

Hence, I would argue for simply pointing at the "How to get a 
certificate via HTTP" RFCs.  It is completely possible that the 
issuer has implemented the certstore-http draft, but that changes 
nothing; they just need to point at a certstore-http-compliant URL.


> 13. Added an editor's note to section 2.8.2 pointing out the need to indicate how
> many keys have to be disclosed.  This is probably a function of the itrace packet
> generation rate and the key change rate.  A reasonable objective is to give a
> reference host some probability (e.g. 80%) that if it receives an itrace pacvket it
> will also receive a successor disclosing the key.  Working out the reference model
> to resolve this may take some discussion.  It may actually turn out to be
> impractible, in which case we have to fall back on the schemes people have suggested
> for the receiving host to interrogate to learn the key.

Here's a random idea: Don't disclose just the previous key. Pick a 
random key from the past n keys and disclose that. (n=5? 10?)
Does this solve the problems with short-lived keys?



-- 
Mikael Olsson, Clavister AB
Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
Fax: +46 (0)660 122 50       WWW: http://www.clavister.com