These comments were addressed in the -02 draft. Replies to individual comments are inline below.
> From: jose [mailto:[email protected]] On Behalf Of Jim Schaad > Sent: Monday, February 02, 2015 8:56 PM > Cc: [email protected] > Subject: [jose] Last Call review for the thumbprint draft > > 1. Please review the email from James Manger on 4/14/14. It is not clear to > me that all of the issues he raised were addressed as there was no > response to the message. Particularly the questions of uniqueness for > black listing of keys. A detailed reply to all of James' comments was sent. Security considerations text about the conditions that must be satisfied to achieve uniqueness of thumbprint values was added. > 2. There seems to be consensus to not define the new header parameter for > the time being. They were removed, per working group input. > 3. There does not seem to be consensus at this time for what the method of > serialization should be at this time. The current method is deemed overly > complicated by a number of people, but nobody has proposed a method that > people can accept as being future proof in the event that a key defines a > structured field for a key parameter. As previously discussed, it's fully expected that most implementations will actually just have fixed templates for the key types they use, so no sorting or other complicated steps will be involved. Lest you blanch at the idea of having type-specific code for computing thumbprints, it's certainly the case that any code *using* keys will be type-specific, so it's not onerous to also use type-specific code to also compute key thumbprints. Nat and I feel that the complication arguments don't stack up well compared to the benefit of having a general description of how to compute a thumbprint that works for any key type. Other's opinions, may of course, differ. ;-) > A new draft can easily address the first two issues. I am not sure what > procedure to follow to address the last one. > > Jim Thanks again, -- Mike & Nat _______________________________________________ jose mailing list [email protected] https://www.ietf.org/mailman/listinfo/jose
