<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I agree that such an approach makes sense, that is if the ballot passes.<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Tim Moses<br><b>Sent:</b> Friday, June 01, 2012 8:54 AM<br><b>To:</b> CABFPub<br><b>Subject:</b> [cabfpub] NameConstraints, PKIX and CABF<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi everyone. I spoke to Stephen Farrell and Sean Turner (the IETF area directors for security) today. We discussed finding the proper way for IETF to interact with the community represented by CABForum, prompted by the recent discussions on how to set the criticality flag for the nameConstraints extension.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sean said that, in order to change RFC 5280, there would have to be demonstrable consensus. It seems clear that we aren’t going to see that condition satisfied, either for this or (quite frankly) pretty much any other topic. So, we should forget about changing RFC 5280.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>However, Stephen suggested that the browser/public-CA community could introduce an individual submission to the PKIX working group explaining how it uses 5280. Violating provisions of 5280 would be perfectly acceptable under this approach. But, it would be good to include the justification. This simply puts it on record how this particular community is using 5280.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Stephen suggested that we wait until we have gained some experience with the non-critical setting of the nameContraints criticality flag, as it seems entirely possible that we’ll run into some unanticipated issues.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sean and Stephen further suggested that (in the longer term) we consider forming a working group within the Operations and Management Area of IETF. This is the vehicle used to record how practitioners are ACTUALLY using IETF specifications. Sometimes their documents strictly profile RFCs and sometimes they record non-conformant practices.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Maybe this would duplicate some parts of our existing process for documenting requirements. But, it is surely worth considering.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>All this (of course) depends on the outcome of Ballot 75.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>All the best. Tim.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>T: +1 613 270 3183<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>