On Thu, Nov 3, 2016 at 8:45 AM, Ben Laurie <[email protected]> wrote: > On 1 November 2016 at 01:04, Peter Bowen <[email protected]> wrote: >> >> There are certificates that have personal information (e.g. given >> name, surname, and physical location) in the subject distinguished >> name or the subject alternative names. It is very possible that there >> may be a desire to redact this information (in fact it could even be >> required in some jurisdictions as CT could be considered a database). >> We already see this with domains in many countries where the full >> registrant details are not publicly available. >> >> Additionally, while 6962-bis does focus on certificates used for TLS >> server authentication, there are other types of certificates that >> could be logged. For example a certificate that is used with email >> and contains both the email address and given/surname. It might be >> that the owner of the certificate only wishes to disclose this binding >> to people receiving email from them rather than publicly disclosing >> it. We have also seen requests for certificates that cover phone >> numbers. A similar situation would apply -- having an "unlisted" >> number should be possible, where the subject details (other than phone >> number) are only known to a group of people who communicate with the >> number. > > For these use cases, something CONIKS-like is probably more appropriate.
How does CONIKS doesn't solve the problem of server authentication certificates that identify an individual as the certificate subscriber? Even if we assume for the moment that 6962bis is only for "traditional" PKI and only for server authentication, these certs are still problematic to log unredacted. Thanks, Peter _______________________________________________ Trans mailing list [email protected] https://www.ietf.org/mailman/listinfo/trans
