SSP Requirements -03

1
SSP Requirements -03

• Michael Thomas
• Mat_at_cisco.com

2
Current Status

• -03 of the draft, in last call now
• Much wordsmithing
• DaveCs input
• Make clear SSP is for first party signatures
• Removed Provisional Requirements except Phills
• 2 open issues

3
Issue 1399(subdomain attack)

• This was always in the current draft under the
  discovery requirements, though perhaps too
  oblique
• New draft tries to be more explicit
• Gist is must the protocol be able to publish
  statements for the domain and its subdomains?
• Scenario SSP record for bigbank.com
• Attacker just uses statements.bigbank.com
• Domain holder cannot wildcard, so its a
  whack-a-mole kind of problem
• Search algorithm potentially costly
• Subdomain walk
• Requirement or not?

4
Issue 1386

• List traffic has been extremely confusing to me
• Text from Phill
• 10. PROVISIONAL The signing policy statement
  MUST be capable of fully describing a signing
  practice in which multiple signatures are always
  provided such that the policy is of utility to
  any verifier is capable of verifying any of the
  signatures that are always provided. Such a
  mechanism MUST NOT
• Require the verifier to perform any additional
  DNS lookups
• Require duplication of configuration data
• In particular not require the policy record to
  provide for the description of any cryptographic
  or canonicalization algorithm
• So is this a requirement or not?

5
Other Issues?

• Nits and other wordsmithing help appreciated
• Is it comprehensible for the larger community?
• Since its status wasnt clear in the beginning,
  it wasnt clear who the audience was
• Input on this front would be helpful too