Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt

Matt Miller <mamille2@cisco.com> Wed, 12 February 2014 20:39 UTC

Return-Path: <mamille2@cisco.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C34091A06D5 for <dane@ietfa.amsl.com>; Wed, 12 Feb 2014 12:39:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.049
X-Spam-Level:
X-Spam-Status: No, score=-10.049 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id et8oCw3cOoTb for <dane@ietfa.amsl.com>; Wed, 12 Feb 2014 12:39:22 -0800 (PST)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) by ietfa.amsl.com (Postfix) with ESMTP id A2E981A06DE for <dane@ietf.org>; Wed, 12 Feb 2014 12:39:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2628; q=dns/txt; s=iport; t=1392237560; x=1393447160; h=message-id:date:from:mime-version:to:subject:references: in-reply-to:content-transfer-encoding; bh=5RKQiqtmUa+hLV3A6nv5fceFISTU3bJlP+6IDDpIo5M=; b=L28B/iPv5859xw1QLJYXn3ewqvQw0vfyIC3Szf92DrPKYco/cM8wm/LA 1K6Ks2lkpemMVrBLl93oyEUmEy4IfWKenXeLC0l3lidZ+JZvjhq55uIi8 W2V0gxIMPAkpov7AWqi380TzF5ol3jGjWPL60OF7L0fPyBMmOtKqx0yJ5 U=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AmQJALDb+1KtJV2Y/2dsb2JhbABagww4V6gXA5cUgRkWdIIlAQEBAwEyAUUGCwsYCRYPCQMCAQIBRQYNBgIBAYd5CMh0F44UMjoWhCIEiRA4jmKSIYNNggo
X-IronPort-AV: E=Sophos;i="4.95,834,1384300800"; d="scan'208";a="19979348"
Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-6.cisco.com with ESMTP; 12 Feb 2014 20:39:19 +0000
Received: from xhc-rcd-x05.cisco.com (xhc-rcd-x05.cisco.com [173.37.183.79]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id s1CKdJ1m008071 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for <dane@ietf.org>; Wed, 12 Feb 2014 20:39:19 GMT
Received: from jack.cisco.com (64.101.72.76) by xhc-rcd-x05.cisco.com (173.37.183.79) with Microsoft SMTP Server (TLS) id 14.3.123.3; Wed, 12 Feb 2014 14:39:19 -0600
Message-ID: <52FBDBF6.5080309@cisco.com>
Date: Wed, 12 Feb 2014 13:39:18 -0700
From: Matt Miller <mamille2@cisco.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
MIME-Version: 1.0
To: <dane@ietf.org>
References: <20140211221320.30490.31053.idtracker@ietfa.amsl.com> <52FAA17F.3060703@cisco.com> <20140211233403.GV278@mournblade.imrryr.org> <52FBB013.2080502@cisco.com> <20140212195413.GG278@mournblade.imrryr.org>
In-Reply-To: <20140212195413.GG278@mournblade.imrryr.org>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Originating-IP: [64.101.72.76]
Subject: Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Feb 2014 20:39:25 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2/12/14, 12:54 PM, Viktor Dukhovni wrote:
> On Wed, Feb 12, 2014 at 10:32:03AM -0700, Matt Miller wrote:
> 
>>> DANE-EE(3) CU records need to have meaningful semantics for the
>>>  publisher.  For example for a publisher to use the same 
>>> certificate for many SRV hosts or without worrying about using
>>> a matching name, the use of non-use of name checks must be
>>> specified precisely.
> 
>>> Therefore I would suggest that the "MAY be ignored" in the
>>> second paragraph of section 5, should be changed to "MUST be
>>> ignored". Otherwise, the published TLSA records have unknown
>>> semantics.
>> 
>> Thank you for the feedback, Viktor.  These comments make sense to
>> me. We'll try to get an update out before the cutoff to address
>> them.
> 
> Thanks.  You could mention that both name checks and key usage are 
> effectively handled by the TLSA record for DANE-EE(3).  The TLSA 
> record binds the certificate or public key to the requested port 
> and protocol at the TLSA base domain, the binding is clearly for a
> TLS server, so there is an implicit key usage of TLS server. 
> Finally, the RRSIG expiration date sets the expiration time of the 
> TLSA "pseudo-certificate".  A requirement to ignore the
> certificate content gives the publisher flexibility (e.g. same
> certificate for multiple SRV hosts, ...).
> 

Section 5 (after I change the "MAY" to a "MUST") already states that
matching a DANE-EE(3) TLSA bypasses the rest of the certificate checks
(paragraph 2), but the current wording might be too clumsy.  I'll see
what I can wordsmith to make it more explicit.

I could also add something about the RRSIG expiration, but isn't that
already covered by RFC4035 § 5.3.1 (bullet 5)?

> There will be some overlap between the SRV draft and the SMTP
> draft. I expect that's not a problem, provided they agree.
> 


- -- 
- - m&m

Matt Miller < mamille2@cisco.com >
Cisco Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBCgAGBQJS+9v2AAoJEDWi+S0W7cO1vDcH/0JiXQus5YsClSbmhjT3/DbR
ILJiUcKYY79yJ1bKDdcsTPF8TaNTuTDN/wtK/ABMfoggD76pJaQ0iCyQLTaL/J61
pkshzeWBKqm2kyfgrwV2hRMOxSsGBc7jWZlrBnHwkOcsxXspJCAFwYUI8X7gzbWc
1L1TCN2+7NCyPz00oj9V7fRN3mDkVFfHPwfI7X87ZihO3dbGA4HSm/DttAmrxbvY
xgk7RUOznaW5SHXU6fRxeWb2DEXsYaPRmrxckauEuI8h52zjszBbAfyOr1XcRG3m
eLHqpLs1yiNQ5x9cqdPHwvm/OhXqDc+BrAftsDrsgMq/Saqb47Q3w0a2vwp6cYM=
=4HNk
-----END PGP SIGNATURE-----