[lamps] Re: Orie Steele's No Objection on draft-ietf-lamps-rfc6712bis-09: (with COMMENT)

"Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com> Thu, 19 December 2024 14:36 UTC

From: "Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com>
To: Orie Steele <orie@transmute.industries>, The IESG <iesg@ietf.org>
Thread-Topic: Orie Steele's No Objection on draft-ietf-lamps-rfc6712bis-09: (with COMMENT)
Thread-Index: AQHbUL/cw4sV3hkl20KeW8Etmh0kALLtnmfw
Date: Thu, 19 Dec 2024 14:36:48 +0000
Message-ID: <DB9PR10MB5715FD18BC22B4C3B05B7552FE062@DB9PR10MB5715.EURPRD10.PROD.OUTLOOK.COM>
References: <173446628454.554415.18156115323965303257@dt-datatracker-59cd88ccf4-xxptp>
In-Reply-To: <173446628454.554415.18156115323965303257@dt-datatracker-59cd88ccf4-xxptp>
Accept-Language: de-DE, en-US
Content-Language: de-DE
msip_labels: MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_ActionId=dd69947c-4fa8-4bd0-86a6-ff5db5c04a27;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_ContentBits=0;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Enabled=true;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Method=Standard;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Name=restricted;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_SetDate=2024-12-19T14:11:52Z;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a;
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=siemens.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DB9PR10MB5715:EE_|GV2PR10MB6140:EE_
x-ms-office365-filtering-correlation-id: 27e82c2a-1283-4fae-d09a-08dd203a91ef
x-ms-exchange-atpmessageproperties: SA
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|366016|38070700018;
x-microsoft-antispam-message-info: Qr9WaMvfpRMFpVE2d8GQ0p62JV1CBTFshCEiqiyK8BKMuD37RQAJj6C1s7IpVka+TCk+Akg7VUoZInjfbeF8qep+choPFvr8eg/FbRYK+sYDL07apHsovatJ8/z931L10CLy68/55Ke+3uEDjUbIUOjst9uA7Td/WH38S567HwMN7PA7161T5J4Nnl73Xxo0T7Qss2RLaXLj6nPHn/1VjWhIij5XiKY0CsmLIbPjkZ+7kuUB60Pdo1h5zyGY15GNoTNjPK3DWnnIf4B9xt+Vw9bc+kZ5zcWEn2Xd/83cX5JYa9FMALlBvomWj8vaQ8I/HDj+RQJYVh3iWVh8bQKpqY1TSxb1Ke5X8OUygZyHzEAh1tJEn1CaiceU9fDEIFym89fvckuKpnSfOHAdAJIsBvhcYWqaIfI8xcIA1+YV9Hkdyj99vHoWZNNrMLLg/SJ9H8koLj2dhO9/rWmj4dsIG7m6EfIun2Sdq1BQSIaj2FAqWrZk3mXs47OiOFEaaFdW7tNXy+FcYNdER6v3NOHENkglOFzULHUXlsOix2XIMv8HV5/Sk1lwnVcH5bgRQh/dcflNRsCC3arAI9b68Rk9W4UAMQ5drTmAgTRUdUQoOa1vZwow/bm+nkXWWRJeQ+dPACtCJSnEJJ6LLA9QyH+MBR4VL0d/TYgaqq5mqZJikAhve5JXu6UHgvYKrVFYjRn8ybaKr0+BV4FSbwpAfRdnPeKYeZ9/nn1xA4jBdm5nIgPciE3gdght7XomrrBYkS1Q1BklCBtg/rfRodzoXyt5ZZQ59E3335+fKF7dbRQFkKP/MWCEW7WkpyC+hAKMmv3Y13XqNpSdU2BNsrpOMJX2JaBX3wl0nY2ocA6BTm12kqZcCk2rv+ypxVgOdgn66PulhiQ6TlKTYjtDuMan/pEFW4cstB6TGynE1bZYlzpv9v9T7uOREiEFs51R3suz6DD0MsuN9gYH+cMvG2JXSjxzIBm2g+rpJFX5Trxm41LqARFp7lK1N7TfHL1S3OSAWTDeFRcc2UffACyLC0GCz+lV7dsb0oMLGYp9tfHUJ6Upc/lkefUbQ6yOI9We8BOGbSmRnuF7zdrFpVvTwyNsWSGmt5S8aZKP4dSDxb9z/IhpWZWSD0EWztYRJJr+DIofyHfUWbqLH3oRZglLQKwcXImkIwlrbjp6JNdRH3IjmsTA8UB5/zkiJyw71aJnE7C9mZhKx5qbODosSIo8bYcGWgGgvCee6mWpl6WWPCr/yC065EXPOewH2m+2DmrTlJk8Qa+NeTw0DZBJiXaBJsbuobigGJC2xH9Y+BOi/3vjezm9Svrr2okFFOKE5MC/mmWN/255nQ+dhPtQU2mJmFYCnFfZfBOStrNw8OnXGlVLug/pT9AnTvsyjCtCEhHRqIq/sPFc
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB9PR10MB5715.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: dsSICRSZ9pHcNjSGl0Y8PCzU4U4WBghBREgEWLCCrExSaunYF6IRKB+hTgS8fK/VQwW+qTdyqceAzn6nBlUHwywyn8ERKXanQWEsER+SJ/aO6KhiW52z9G66yoyVRFx8i0QEVQgcJ3R2/KL1x/XOy5Nr20UMdlXGlwFEQwj+PTE1P65SUHEz0RPEDv4oZ2I8vXCOPBisAiKcKCABndfMl5OI/sED00K6IWXCPsi3lg1D+oPYF4srArguyibBMepHlSVUJ0RdO7TwlWWKN9H7PkuF68nNdTkDQKG/rRbDOZtT0nQcLTei4moda8yj5L5MhTltutyg/bU3mbdhKy5y/akU/B3TrbbmubiC6j7n9k3RuE2dhxz49X3/GZKE3Kq9dAw3zz/OBIkhD/PUTQLpD9EB249hsyIS1P49Ju5ebPshZUKtXlUyBqAFEWmM6L6wytU3RqLfXV4uGKAKzTuDixXAXaukpMSBDHug/QrsbO+TTDllSdSCbFwp6ey53UjuSMisqibIhDKpbBF6FBMiYbIL7rB3nZ1eiYY9t7lKEY66k8jKEaAX/lT1TniXm86qP/PoERqf/arOrRpJcyUh8S0lhHhg7jClujhJj57x5LpOTnMQOTZDE/6PLUX9UOpd3TvY9fLhfXDGC2EW7opSYibnRKZoqe906ZNKhp6oP9RCYowQdp+b9q8/nxzl8ClIYX/KBEyESBIDUGG07jGXiI7nuezv0Y5nGUl/0xevuuqdaT+VpV6aENq0kK5M8QyDm6+X/vTqu531qkFe8ZiitYBT7wiO9omUoH4kmWS+2bNErr3YEUL9H1ov4wNNzagv15H9x/Hur/qEDTB1iKH5JKmTuYFy0gsgBva2Y9UEVdzeIHyyA2eJjXwXNgMhv89/jqRo+i96uRGxKkOlos0Irvg09q0IEf+jnEAfQqPQHh5sapVK2hXNJOjcJK+dBsv1Z2knZlKjq6D/8bxR8CFHy+a6ahaRVdlogkKBek7jsb01vU9RhDMui6XhiJUvAj+BDmFs6RfpCdddJU6QWtsXvIjaHTyfl34f9OprrPr3B6HfpWDgS6iiu1SJiCsltl+TTYvPc7GHiMOn8zy+O7a8D4ovut9ffNcDXFFabB1J5mGVzlJtlozIu/ij7y2WNRMuv0I5JdBfbfSr3JETwsK5KjenWp7mBY9C5N/f/mCVmxrKmhI3qMMdXHOh4WtOMEyKWt/ylwjSTLmcL0dcGQEWLVW8yzBWWRtIDEZObxvBhIsge7t79TBSyNaIIyGGXGTo+1aq8rfQem4zlwD48e6OVj6E9TgBFfF8OrEu7zRbzjXMR4di08wjp1jL3unLurzFO0GfBqIjbkX00rvWsyJY0ZI03hElPRFo3S3dTXlMG7wCAT12zgy+77lwat2Fz3En85q61FoCLP5lyrC98p6d9YsCajurVlhRZEhx5rS61fgVr7m67q8ZHifNoSmfD61TP+T3aKPFrEom6L0Qqi2qDMRsg/LWhDdy8JDH5kqiEFRZyFm4xJ0J4Pu5SgCKr6VzRPSlRSmscu+viTPDm44lB88INtDlLTvq1+DIgWgvAz2GtKv2GPLT7SQH7sSnBQHcR5Bed80i1XojOYyrT8rOwA==
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB9PR10MB5715.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 27e82c2a-1283-4fae-d09a-08dd203a91ef
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2024 14:36:48.4767 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 3t2t6WJEPAd68ekFPLjj+jW9sL89cs+D/ugp4czP8n+CQVEIxSgSrmkIrgtsX9HQ9Z53T4wT9KiT1aPrgwZswVkAnJsZNbgY0kLd9PVYaIY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV2PR10MB6140
Message-ID-Hash: 4MBKONFNG2NH73WJXWMTDNS6NKAFN45P
X-Message-ID-Hash: 4MBKONFNG2NH73WJXWMTDNS6NKAFN45P
X-MailFrom: hendrik.brockhaus@siemens.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "draft-ietf-lamps-rfc6712bis@ietf.org" <draft-ietf-lamps-rfc6712bis@ietf.org>, "lamps-chairs@ietf.org" <lamps-chairs@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>, "housley@vigilsec.com" <housley@vigilsec.com>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: Orie Steele's No Objection on draft-ietf-lamps-rfc6712bis-09: (with COMMENT)
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/W3kQtF7QLGU505g7A4X_EM2Jjlo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Orie

Thank you for your comments.
See my response below.

Hendrik

>Von: Orie Steele via Datatracker <noreply@ietf.org>
>Gesendet: Dienstag, 17. Dezember 2024 21:11
>
>Orie Steele has entered the following ballot position for
>draft-ietf-lamps-rfc6712bis-09: No Objection
>
>When responding, please keep the subject line intact and reply to all email
>addresses included in the To and CC lines. (Feel free to cut this introductory
>paragraph, however.)
>
>
>Please refer to
>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%25
>2Fabout%2Fgroups%2Fiesg%2Fstatements%2Fhandling-ballot-
>positions%2F&data=05%7C02%7Chendrik.brockhaus%40siemens.com%7C95198
>b47029b47ccf47608dd1ed6fd9a%7C38ae3bcd95794fd4addab42e1495d55a%7C1
>%7C0%7C638700630907522386%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU
>1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUI
>joyfQ%3D%3D%7C0%7C%7C%7C&sdata=osMsw%2Fmn79WZrUpwnhVj%2FfvLa
>y7USqmSwu0wk44oWVA%3D&reserved=0
>for more information about how to handle DISCUSS and COMMENT positions.
>
>
>The document, along with other ballot positions, can be found here:
>https://datatracker.ietf/.
>org%2Fdoc%2Fdraft-ietf-lamps-
>rfc6712bis%2F&data=05%7C02%7Chendrik.brockhaus%40siemens.com%7C9519
>8b47029b47ccf47608dd1ed6fd9a%7C38ae3bcd95794fd4addab42e1495d55a%7C
>1%7C0%7C638700630907541087%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0e
>U1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIld
>UIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3CbEs5%2BKjTyj1P39CCTh5yTnev
>%2FYSjkH2vLVMNIG6as%3D&reserved=0
>
>
>
>----------------------------------------------------------------------
>COMMENT:
>----------------------------------------------------------------------
>
>Thanks to Claudio Allocchio for the ARTART review, and to the authors for
>addressing the feedback.
>
>I still wonder if section 3.4 should more strongly encourage the use of HTTPS
>through examples, why not:
>
>```
> https://www.example.com/.well-known/cmp
>
> https://www.example.com/.well-known/cmp/<operation>
>
> https://www.example.com/.well-known/cmp/p/<name>
>
> https://www.example.com/.well-known/cmp/p/<name>/<operation>
>
>Note that http can also be used instead of https, see item 5 in the Security
>Considerations (Section 5).
>
>```

[HB] This was discussed during the OPSDIR review, see https://mailarchive.ietf.org/arch/msg/spasm/-i992Y4hOShbnu0a6eRlnkhg3BE/.
CMP offers all protection mechanism that are needed for certificate management. The content of certificates is typically not confidential as it it provided to the relying parties anyhow. Therefore, the TLS layer is an optional addition, because
- CMP does not necessarily require transport layer protection if data-origin authentication using MAC-based or signature-based message protection is applied.
- There are cases where an entity initially has no certificate and no trust anchor. In these cases, it would even be unable to perform TLS server authentication.
But you are right, TLS is often applied as second line of defense and for privacy reasons.

[lamps] Re: Orie Steele's No Objection on draft-i… Brockhaus, Hendrik
[lamps] Orie Steele's No Objection on draft-ietf-… Orie Steele via Datatracker