Re: [dane] Behavior in the face of no answer?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> Before we discuss how to proceed, I think it would be useful to get
> agreement on the security analysis.

Analysis (about what the attacker could do) is correct, but ...

>
> I claim that for Usages 0 and 1, treating TLSA non-response as if no
> TLSA records exist means that DANE adds minmal/no security value for
> those usages. If people disagree with that,

I do not fully agree to the conclusion.
With the exact same logic, when comparing DV-certs to EV-certs, you
could say that EV-certs add minimal/no security value.

I believe it is OK for DANE to be a building block for security,
rather than a security silver bullet (something I believe doesn't exist).

What value is offered depends entirely on whether you use that extra
information of entirely ignore it.  If it's ignored, then there is
no value, and that should not come as a surprise.

Web Browsers provide visual cues to differentiate DV/EV-certs (since
very few users look at the certificate details. 

Another possibility (previously mentioned) would be to get rid of
the PKIX-style Alzheimer approach to security and memorize characteristics
from previous encounters with peers an reuse those memories on
re-encounters, similar to how evolution taught mammals develop
trust relationships.


Any new IETF protocol that treats smooth migration of the
installed base as serious and important as IPv6 does it for users
of IPv4, will see a similarly rapid migration&adoption of the
technology by consumers that IPv6 has been seeing over the last decade.


-Martin