IETF Logo Mail Archive

Re: [dane] Extending TLSA RFC to operate with TLS's new raw public keys

James Cloos <cloos@jhcloos.com> Wed, 04 June 2014 02:34 UTC

Return-Path: <cloos@jhcloos.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CBDE1A01A6 for <dane@ietfa.amsl.com>; Tue, 3 Jun 2014 19:34:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.652
X-Spam-Level:
X-Spam-Status: No, score=-2.652 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.651, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQa1YOeuxk_1 for <dane@ietfa.amsl.com>; Tue, 3 Jun 2014 19:34:30 -0700 (PDT)
Received: from ore.jhcloos.com (ore.jhcloos.com [198.147.23.85]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 713331A01C1 for <dane@ietf.org>; Tue, 3 Jun 2014 19:34:29 -0700 (PDT)
Received: by ore.jhcloos.com (Postfix, from userid 10) id CE59A1DFD6; Wed, 4 Jun 2014 02:34:23 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jhcloos.com; s=ore14; t=1401849263; bh=qrayyTi1ivBThk5eXhtUkNqgTAM00zwwF9SdxKUILIc=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=CR+u9qaIDh9FNGls7C5ez30Kuax1RD44jVCGZ7nlt7U1utp6LmOmyQTMlyJibgsL+ 342s6HEJhCmStd7uQNZKYwxCiRGPqhFJ/Yh1tbr1jvJjyZfu0hn1hjT/Q2/nOzF+5+ eWGamV4ZUCr4BBip8T8I2eAv6huM4D4U6uROqSgc=
Received: by carbon.jhcloos.org (Postfix, from userid 500) id 36C076001E; Wed, 4 Jun 2014 02:26:37 +0000 (UTC)
From: James Cloos <cloos@jhcloos.com>
To: Viktor Dukhovni <viktor1dane@dukhovni.org>
In-Reply-To: <20140603130839.GY27883@mournblade.imrryr.org> (Viktor Dukhovni's message of "Tue, 3 Jun 2014 13:08:40 +0000")
References: <201405290805.s4T85HBT008757@new.toad.com> <76254E90-245A-4502-AFBE-74A3038BB08F@vpnc.org> <OFB1999EAD.836E27A5-ON85257CE8.0067D557-85257CEB.000B5F5E@us.ibm.com> <20140602022733.GK27883@mournblade.imrryr.org> <538C86C7.8000805@cs.tcd.ie> <20140602145215.GP27883@mournblade.imrryr.org> <20140602172922.GS27883@mournblade.imrryr.org> <alpine.LFD.2.10.1406030056500.19868@bofh.nohats.ca> <20140603130839.GY27883@mournblade.imrryr.org>
User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/24.4.50 (gnu/linux)
Face: iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAgMAAABinRfyAAAACVBMVEX///8ZGXBQKKnCrDQ3 AAAAJElEQVQImWNgQAAXzwQg4SKASgAlXIEEiwsSIYBEcLaAtMEAADJnB+kKcKioAAAAAElFTkSu QmCC
Copyright: Copyright 2014 James Cloos
OpenPGP: 0x997A9F17ED7DAEA6; url=https://jhcloos.com/public_key/0x997A9F17ED7DAEA6.asc
OpenPGP-Fingerprint: E9E9 F828 61A4 6EA9 0F2B 63E7 997A 9F17 ED7D AEA6
Date: Tue, 03 Jun 2014 22:26:37 -0400
Message-ID: <m3k38x5s09.fsf@carbon.jhcloos.org>
Lines: 18
MIME-Version: 1.0
Content-Type: text/plain
X-Hashcash: 1:30:140604:viktor1dane@dukhovni.org::Q7cj41QdUgyVEZus:000000000000000000000000000000000000+/jA3
X-Hashcash: 1:30:140604:dane@ietf.org::/iC1nZfVOigSkU31:000fEF5P
Archived-At: http://mailarchive.ietf.org/arch/msg/dane/V5q_EgU2ak41W6BbQiovEI3BRRk
Cc: dane@ietf.org
Subject: Re: [dane] Extending TLSA RFC to operate with TLS's new raw public keys
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Jun 2014 02:34:31 -0000

>>>>> "VD" == Viktor Dukhovni <viktor1dane@dukhovni.org> writes:

VD> It isn't.  I just wanted to spell it out.  DANE clients send SNI,
VD> even if when they use "oob public key".  As in my reply to John
VD> Gilmore, if everyone agrees this is obvious, it is not essential
VD> (but harmless, no?).

Just as a point of reference, SNI is irrelevant for all of my tls
servers and their tlsa records.

I'm sure I'm not alone in that.

So I also do not understand why the oob document(s) should need to say
anything about sni.

-JimC
--
James Cloos <cloos@jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6

v2.23.0 | Report a Bug | By Email