Re: [dane] Behavior in the face of no answer?

[Eric Rescorla <[e-mail]>]

On Fri, May 4, 2012 at 12:05 PM, Eric Rescorla <[e-mail]> wrote:
> On Fri, May 4, 2012 at 12:02 PM, Martin Rex <[e-mail]> wrote:
>> Eric Rescorla wrote:
>>>
>>> Before we discuss how to proceed, I think it would be useful to get
>>> agreement on the security analysis.
>>
>> Analysis (about what the attacker could do) is correct, but ...
>>
>>>
>>> I claim that for Usages 0 and 1, treating TLSA non-response as if no
>>> TLSA records exist means that DANE adds minmal/no security value for
>>> those usages. If people disagree with that,
>>
>> I do not fully agree to the conclusion.
>> With the exact same logic, when comparing DV-certs to EV-certs, you
>> could say that EV-certs add minimal/no security value.
>
> It's precisely for this reason that EV certs add minimal security value.

I should mention that there are potentially settings in which they add
more security value, e.g., EV-lock. Also, at least in principle they
allow a user to have some trust in the organization name as
opposed to the DN, which is not something that DANE provides.

-Ekr