Subject: [100attendees] Side Meeting on considerations on using short-term certificates.

From: Yoav Nir <[email-masked]>
Date: Mon, 13 Nov 2017 10:45:18 +0800

Hi, all

In recent years there’s been growing interest in short-term automatically-renewed (STAR) certificates.  The idea is to renew certificates often and forego revocation checking.

ACME has a draft for such certificate, and STIR has a candidate among others.

STAR certificates have somewhat different operational and security properties compared to regular PKI.  I’ve tried to document some of them in a draft:
https://tools.ietf.org/html/draft-nir-saag-star-00
This draft is in a very initial state, and I’m looking for input about this.

I’ve reserved the Hullet room on Thursday at 18:00.  Anyone who’s interested is invited.

Hope to see you there

Yoav

---

From: Melinda Shore <[email-masked]>
Date: Mon, 13 Nov 2017 11:01:28 +0800

This conflicts with the IRSG dinner, but folks who are interested
might be interested that we'll be discussing short-term certificates
and certificate transparency during this afternoon's trans session.

Melinda

-- 
Melinda Shore
[email-masked]
Software longa, hardware brevis

---

From: Robert Moskowitz <[email-masked]>
Date: Mon, 13 Nov 2017 11:17:13 +0800

Conflicts with CBOR and ACME.  And Melinda's TRANS conflicts with SUIT.

Always conflicts.  This is way in the old days of BAR BOFS, they were 
held around 10pm...

Bob

On 11/13/2017 10:45 AM, Yoav Nir wrote:
> _______________________________________________
> 100attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/100attendees

-- 
Standard Robert Moskowitz
Owner
HTT Consulting
C:248-219-2059
F:248-968-2824
E:[email-masked]

There's no limit to what can be accomplished if it doesn't matter who 
gets the credit

---

From: Yoav Nir <[email-masked]>
Date: Mon, 13 Nov 2017 21:21:51 +0800

CBOR and ACME both end at 17:50, 10 minutes before we begin.

> On 13 Nov 2017, at 11:17, Robert Moskowitz <[email-masked]> wrote:
> 
> Always conflicts.  This is way in the old days of BAR BOFS, they were held around 10pm...
> 
> Bob
> 
>> https://tools.ietf.org/html/draft-nir-saag-star-00 <https://tools.ietf.org/html/draft-nir-saag-star-00>
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/100attendees <https://www.ietf.org/mailman/listinfo/100attendees>
> 
> --
> Robert Moskowitz
> Owner
> HTT Consulting
> C:      248-219-2059
> F:      248-968-2824
> E:      [email-masked] <mailto:[email-masked]>
> 
> There's no limit to what can be accomplished if it doesn't matter who gets the credit

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 14 Nov 2017 10:16:59 +0800

ARGH!  you are right.

And CURDLE has been canceled, so there is only MILE.  I will see what I 
can do, would like to join you.

Bob

On 11/13/2017 09:21 PM, Yoav Nir wrote:
>> On 13 Nov 2017, at 11:17, Robert Moskowitz <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>

---

From: Ori Finkelman <[email-masked]>
Date: Tue, 14 Nov 2017 10:29:29 +0800

Hi Yoav,
Unfortunately it collides with CDNI session.
It would be good to consider to the work done in CDNI and specifically
https://tools.ietf.org/html/draft-fieau-cdni-https-delegation-02#section-5
where the use of STAR is considered.
Also, a specific use case would be the delegation of traffic from a
commercial CDN to an ISP CDN, in which case the domain and certs still
belong to the content provider.
So there may be a short term certs relationship between the content
provider and their CDN and then to the ISP.

Ori

On Mon, Nov 13, 2017 at 10:45 AM, Yoav Nir <[email-masked]> wrote:

> Hi, all
>
> In recent years there’s been growing interest in short-term
> automatically-renewed (STAR) certificates.  The idea is to renew
> certificates often and forego revocation checking.
>
> STAR certificates have somewhat different operational and security
> properties compared to regular PKI.  I’ve tried to document some of them in
> a draft:

-- 

*Ori Finkelman*Qwilt | Work: +972-72-2221647 | Mobile: +972-52-3832189 |
[email-masked]

---

From: Yoav Nir <[email-masked]>
Date: Tue, 14 Nov 2017 10:56:13 +0800

Thanks.  My co-authors are also the authors of the ACME STAR draft that is somewhat about the delegation case.

> On 14 Nov 2017, at 10:29, Ori Finkelman <[email-masked]> wrote:
> 
> Hi Yoav,
> It would be good to consider to the work done in CDNI and specifically https://tools.ietf.org/html/draft-fieau-cdni-https-delegation-02#section-5 <https://tools.ietf.org/html/draft-fieau-cdni-https-delegation-02#section-5> where the use of STAR is considered.
> Also, a specific use case would be the delegation of traffic from a commercial CDN to an ISP CDN, in which case the domain and certs still belong to the content provider.
> So there may be a short term certs relationship between the content provider and their CDN and then to the ISP.
> 
> Ori
> 
> 
> On Mon, Nov 13, 2017 at 10:45 AM, Yoav Nir <[email-masked] <mailto:[email-masked]>> wrote:
> Hi, all
> 
> Ori Finkelman
> Qwilt | Work: +972-72-2221647 | Mobile: +972-52-3832189 | [email-masked] <mailto:[email-masked]>