Re: [dane] Behavior in the face of no answer?

[Yoav Nir <[e-mail]>]

On May 4, 2012, at 7:18 PM, Adam Langley wrote:

> On Fri, May 4, 2012 at 12:08 PM, Eric Rescorla <[e-mail]> wrote:
>> Before we discuss how to proceed, I think it would be useful to get agreement
>> on the security analysis. I claim that for Usages 0 and 1, treating
>> TLSA non-response
>> as if no TLSA records exist means that DANE adds minmal/no security
>> value for those
>> usages.
> 
> I believe that you're completely correct.
> 
> Browsers are not going to enable DANE hard fail in the short or medium
> term because of the fraction of clients that have broken DNS and can't
> fetch the records.
<snip />
> However, browsers are not the world. Other clients, which may benefit
> from a smaller, more controlled, deployment may be able to enforce
> DANE hard-fail and see security benefits.
> 
> I would personally suggest that the spec requires hard fail, or at
> least discusses the fact that, without hard-fail, the security
> benefits are moot. Implementations frequently ignore requirements in
> specs, but rarely add to them!

I disagree. I would hate for this group to publish a spec with a MUST level requirement that we fully expect all browsers to ignore. At best this should be a SHOULD with an explanation that not doing this eliminates usages 0 and 1. 

I can think of a heuristic for this. Suppose we have to domain names, one with a valid TLSA record, the other without. The browser could query the DNS for a TLSA record for both of these, and if both answers are received, then TLSA works. In that case, a timeout can rightfully become a hard fail. If no response is received to either query, then either the DNS is broken or the attack is already going on. In that case the user should be warned with the likelier of the two - that the DNS seems to be broken, and certain kinds of attack are possible.

Yoav