Re: [dane] Draft for serializing DNSSEC chains

[Martin Rex <[e-mail]>]

Eric Osterweil wrote:
> 
> >
> > AFAIK, the original TLS extension was a single OCSP response, and then
> > all CAs added intermediate certs so that a single OCSP response was
> > no longer sufficient to validate a server certificate.
> >
> > The proposal for a new TLS extension to carry more than a single
> > OCSP reponse is still an internet draft:
> > https://datatracker.ietf.org/doc/draft-pettersen-tls-ext-multiple-ocsp/
> >
> 
> Yes, but are you aware of the _operational_ problems?  Is the 
> distinction between design complexity and operational complexity not 
> clear?  If so, is anyone else on the list concerned?

I do not see any (additional) operational problems.

The server is *ALWAYS* in a better position to obtain OCSP responses
for his own server cert and cache it, and the same goes for DANE records.

So from the operational standpoint, using a TLS extension to
convey the information significantly facilitates the communication
with the _correct_ server.  It doesn't help when talking to an
attempted imposter.


> 
> >
> > The security design of DANE does not have a dependency on the transport
> > that is used to convey the signed DNS records.  Neither does OCSP and 
> > CRLs.
>
> Actually, it very much does.  If operational issues open attack vectors 
> (which they will in this case), then I think the security design (by 
> definition) has a dependency.  Is the vector still unclear?

Nope, it does not.

The only things in dane that is security-relevant during verification
is the signed records and the the RRSIG lifetimes.  The transport
as well as all TTLs are completely irrelevant.


-Martin