Subject: Re: TLS server identity verification

From: =JeffH <[email-masked]>
Date: Mon, 08 Jun 2009 12:39:18 -0700

cullen said:
 >
 > having one "cook
 > book" Standards Track RFC that all new things can point at and say,
 > just do it like RFC AAAA says to do it would be great.

that's a reasonable summary of what Chris Newman overall desired when he tugged 
my sleeve a while back wrt concocting this I-D.

Kurt had said:
 >
 > I suggest instead the title "TLS Server Identity Verification in
 > Application Protocols", for the document to discuss various ways for
 > TLS server identity verification to be done and be organized such
 > that application protocol specifications can easily "profile" this
 > document in order to specify the application protocol specific
 > procedure.  I think the document should be targeted for the Standard
 > Track.

That's an explicit refinement of the original goal, and could be the way to go.

 > I also think it would be useful to have a document indicating which
 > ways are "best current practice", but thinking this might be better
 > placed in a separate document.

Hm, maybe so. But then there's the issue of yet more specs/docs and which to 
reference when. Could it be done in one doc?

=JeffH

---

From: Kurt Zeilenga <[email-masked]>
Date: Thu, 11 Jun 2009 18:24:24 -0700

On Jun 8, 2009, at 12:39 PM, =JeffH wrote:

> that's a reasonable summary of what Chris Newman overall desired  
> when he tugged my sleeve a while back wrt concocting this I-D.
>
> Kurt had said:
> >
> Hm, maybe so. But then there's the issue of yet more specs/docs and  
> which to reference when. Could it be done in one doc?

Yes.   For instance, the document could have one part which detailed  
various ways one could verify the server identity and separate part  
which discussed the applicability (in general to application-level  
protocols) of each way.   That is, one part "technical specification"  
and one part "applicability statement" or "best current practice".