On 7/16/15 9:04 AM, Richard Barnes wrote: > On Thu, Jul 16, 2015 at 12:44 AM, Joe Hildebrand <hildjj@xxxxxxxxxxx> wrote: >> On 15 Jul 2015, at 5:37, David Conrad wrote: >> >>> I try to be pragmatic. Given I do not believe that refusing to put ONION >>> in the special names registry will stop the use of .ONION, the size of the >>> installed base of TOR implementations, and the implications of the use of >>> that string in certificates, I supporting moving ONION to the special names >>> registry. I really (really) wish there was more concrete, objective metrics >>> (e.g., size of installed base or some such), but my gut feeling is that TOR >>> is pretty well deployed and given the CAB Forum stuff, I see no particular >>> reason to delay (after all, it's not like the deployed base of TOR is likely >>> to get smaller). >> >> >> I don't see any mention of the CAB Forum stuff in the draft. Has anyone >> done the analysis to see if CAB Forum members really will issue certs to >> .onion addresses if we do this? Do they issue certs for .example or .local >> today? > > There are at least a few CAs issuing for .onion right now, under the > exceptions that are going to expire in a few months. So I assume that > these CAs will be interested in issuing if policy allows. > > My understanding is that the basic requirement that CABF has is that a > name either be clearly a valid DNS name or clearly *not* a valid DNS > name. (And in either case, that the applicant be able to demonstrate > control.) Right now, that's ambiguous. Adding .onion to the RFC 6761 > registry would remove the ambiguity, since it would officially mark > names under .onion as not DNS names. I won't presume that we can tell the CAB Forum folks what they can do. They've stated what they intend to do and it seems likely that the will carry through with that. https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ > --Ricahrd > > > >> If certificate issuance is one of the key drivers for this work, there needs >> to be information in the draft that shows that this approach will work. I think there's a certain amount of moral hazard associated with being extremely concerned about the conisderations arising from that. it may be the case that they have a deadline, whether it gets added to the registry or not should come down to the merit of the request and it's congruence with how we run that registry. >> -- >> Joe Hildebrand >> >> >> _______________________________________________ >> DNSOP mailing list >> DNSOP@xxxxxxxx >> https://www.ietf.org/mailman/listinfo/dnsop > > _______________________________________________ > DNSOP mailing list > DNSOP@xxxxxxxx > https://www.ietf.org/mailman/listinfo/dnsop >
Attachment:
signature.asc
Description: OpenPGP digital signature