Re: [dane] MX and DANE (Was: AppsDir review of

[Martin Rex <[e-mail]>]

Mark Andrews wrote:
> 
> O. writes:
> >
> > On 3. 5. 2012, at 17:25, Richard L. Barnes wrote:
> > > Oh, this discussion again.
> > 
> > No, it's _not_ that discussion again.  I wanted to say that we
> > don't _want_ to discuss and fix it in the DANE WG.  Somebody fix
> > it elsewhere and come back.

100 ack.

> 
> While this isn't be a issue for DANE, DANE actually *removes* the
> last known threat, downgrade by filtering/not offering STARTTLS
> from the EHLO response, to making MX and STARTTLS work globally as
> it provides a method to signal that TLS should be available and as
> a consequence you should see a STARTTLS.


Please do not confuse DANE with DNSSEC.

example:

    foo.x.         IN MX     10  mx.bar.y.
    mx.bar.y.      IN CNAME      tweety.baz.z.
    tweety.baz.z.  IN A          0.1.2.3

plus:
    foo.x. is a DNS-Zone with DNSSEC enabled
    bar.y. is a DNS-Zone without DNSSEC
    baz.z. is a DNS-Zone with DNSSEC enabled

The DNS software module does not know about MX records and will
not look at any of the above.

To _me_ this looks like opening a can of worms, not like closing one,
and the apps protocols that want such scenarios secured by DNSSEC,
will have to design and discuss their desired security architecture,
how to perform&implement the various lookups and possible indirections,
how to compute the desired result/outcome from the various possibilities
leveraged by the DNS magic machinery and describe:

   - to implementers of the apps protocol how to implement this
   - to admins of the machines how to configure the various possible
     scenarios

and provide a security considerations about all the potential and
non-obvious pitfalls.

Btw. in the example above, "mx.bar.y. IN CNAME tweety.baz.z."
could have been a DNS reply spoofed by an attacker.

I have significant doubts, that DANE is the right forum to discuss any
of these very apps-specific characteristics and requirements.
And DANE-protocol LC is definitely the wrong time for it
(IIRC, the DANE WG tabled this discussion before it got deeply ratholed
 over it).

*I* really do not want to discuss this any further.

-Martin