Re: [dane] Behavior in the face of no answer?

[Eric Rescorla <[e-mail]>]

On Fri, May 4, 2012 at 8:57 AM, Warren Kumari <[e-mail]> wrote:
> <chair hat>
>
> Hi there all,
>
> First off, thanks for keeping this civil. This is an important issue (and one that we've skirted around in the past..), lets try and prevent it becoming contentions as well :-)
>
> So, it seems (to me!) that both Eric and Andrew have perfectly sane and defendable positions, but diametrically opposed.
> This is (IMO) something that we are going to have to resolve before this is published, so I am asking our AD to consider holding off...
>
>
> </chair hat>
>
> So, how does the WG feel about a knob that can be turned to choose behavior? Something that can be set for the less secure manner for now, and then (the default) changed later?
> Security conscious / at risk folk would be able to turn the knob now...
>
> Worst idea ever?

Before we discuss how to proceed, I think it would be useful to get agreement
on the security analysis. I claim that for Usages 0 and 1, treating
TLSA non-response
as if no TLSA records exist means that DANE adds minmal/no security
value for those
usages. If people disagree with that, I would like to hear someone describe
a threat model under which DANE with this policy would prevent attacks
that would otherwise succeed.

Until we agree on that, I don't think there's much point in discussing what the
document ought to say.

-Ekr