IETF Logo Mail Archive

Re: [dane] Behavior in the face of no answer?

Nicholas Weaver <nweaver@icsi.berkeley.edu> Thu, 03 May 2012 22:03 UTC

Return-Path: <nweaver@icsi.berkeley.edu>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDFCB21F8652 for <dane@ietfa.amsl.com>; Thu, 3 May 2012 15:03:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IZcfHmBUcazk for <dane@ietfa.amsl.com>; Thu, 3 May 2012 15:03:34 -0700 (PDT)
Received: from rock.ICSI.Berkeley.EDU (rock.ICSI.Berkeley.EDU [192.150.186.19]) by ietfa.amsl.com (Postfix) with ESMTP id 62AED21F8646 for <dane@ietf.org>; Thu, 3 May 2012 15:03:33 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1]) by rock.ICSI.Berkeley.EDU (Postfix) with ESMTP id E0EAE2C400D; Thu, 3 May 2012 15:03:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ICSI.Berkeley.EDU
Received: from rock.ICSI.Berkeley.EDU ([127.0.0.1]) by localhost (maihub.ICSI.Berkeley.EDU [127.0.0.1]) (amavisd-new, port 10024) with LMTP id uMVF4VV8BxW4; Thu, 3 May 2012 15:03:32 -0700 (PDT)
Received: from gala.icir.org (gala [192.150.187.49]) (Authenticated sender: nweaver) by rock.ICSI.Berkeley.EDU (Postfix) with ESMTP id A1BBD2C4002; Thu, 3 May 2012 15:03:32 -0700 (PDT)
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: text/plain; charset=us-ascii
From: Nicholas Weaver <nweaver@icsi.berkeley.edu>
In-Reply-To: <CABcZeBMY26xrfvAx=UsYN2XnuONZ2vPy9tNwHQALudd=yQDvgA@mail.gmail.com>
Date: Thu, 3 May 2012 15:03:32 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <39F82CB2-9421-4248-955E-CB29012928B3@icsi.berkeley.edu>
References: <CABcZeBMY26xrfvAx=UsYN2XnuONZ2vPy9tNwHQALudd=yQDvgA@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
X-Mailer: Apple Mail (2.1257)
Cc: dane@ietf.org
Subject: Re: [dane] Behavior in the face of no answer?
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 May 2012 22:03:35 -0000

On May 3, 2012, at 2:55 PM, Eric Rescorla wrote:

> I've been reading -20 and I'm not sure I understand the behavior that section
> 4.1 is supposed to say. Consider the following case:
> 
> I am trying to connect for the first time to https://www.example.com/,
> which is signed. I go to retrieve the TLSA record, but when I do so,
> the request times out. What do I do? There seem to be two options:
> 
> (a) Treat this as a hard failure and abort the connection.
> (b) Treat this as if I have an empty TLSA response and continue with ordinary
> TLS.
> 
> I claim that the right response from a security perspective is clearly (a): hard
> fail. If you agree with me, then jump to "2. DOCUMENT TEXT" below. If not, keep
> reading.

I agree: If A www.example.com resolves but the TLSA record times out (which is required for it to even reach this state in a benign or malicious form), Thats Bad (tm).

And I agree that the text should probably say "Treat nonresponsive as Bogus"

v2.8.7 | Report a Bug | By Email