[TLS]Re: Trust Expressions Update

2024-07-23 Thread Dennis Jackson
On 21/07/2024 18:09, Kyle Nekritz wrote: Do you see differences with trust negotiation, or in the specific negotiation mechanisms that are being proposed? Or would you have similar concerns if, say, we didn't already have named group negotiation, and were discussing adding that right now? M

[TLS]Re: Trust Expressions Update

2024-07-21 Thread Rob Sayre
On Sun, Jul 21, 2024 at 6:10 PM Kyle Nekritz wrote: > On the surveillance risks, what differentiates trust negotiations from > other existing negotiation mechanisms? Any negotiation mechanism comes with > risks that it will be used to negotiate something problematic. It's not > clear to me why tr

[TLS]Re: Trust Expressions Update

2024-07-21 Thread Kyle Nekritz
have named group negotiation, and were discussing adding that right now? -Original Message- From: Dennis Jackson Sent: Thursday, July 18, 2024 3:25 PM To: tls@ietf.org Subject: [TLS]Re: Trust Expressions Update On 29/06/2024 00:14, David Benjamin wrote: > We have published a second,

[TLS]Re: Trust Expressions Update

2024-07-19 Thread Stephen Farrell
Hiya, I still need to re-read the trust expressions docs, though my sympathy remains with Dennis' arguments so far. That said, and independent from the rest of the discussion, FWIW I don't think the particular argument below is sound. On 20/07/2024 00:05, Ryan Hurst wrote: It is also worth no

[TLS]Re: Trust Expressions Update

2024-07-19 Thread Mike Shaver
I think this highlights the importance of TLS as a specification used on the web (versus being used an arbitrary protocol between two endpoints) being explicit about what assumptions it is making about how root programs are operated, and how the choices of those root programs manifest for users. I

[TLS]Re: Trust Expressions Update

2024-07-19 Thread Ryan Hurst
The risks of eIDAS did not come from the existence of a trust list, nor would they have been amplified by server adoption or negotiation mechanisms for the trust list. The existence of a trust anchor negotiation mechanism such as Trust Expressions does not change the fact that the security risk con

[TLS]Re: Trust Expressions Update

2024-07-18 Thread Dennis Jackson
On 29/06/2024 00:14, David Benjamin wrote: We have published a second, related draft, TLS Trust Anchor Identifiers. This draft outlines a separate mechanism we had considered during the design of TLS Trust Expressions, and is intended to solve many of the same problems that Trust Expressions d