Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt
Matt Miller <mamille2@cisco.com> Wed, 12 February 2014 20:39 UTC
Return-Path: <mamille2@cisco.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com
(Postfix) with ESMTP id C34091A06D5 for <dane@ietfa.amsl.com>;
Wed, 12 Feb 2014 12:39:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.049
X-Spam-Level:
X-Spam-Status: No,
score=-10.049 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,
DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.548,
SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com
[127.0.0.1]) (amavisd-new, port 10024) with ESMTP id et8oCw3cOoTb for
<dane@ietfa.amsl.com>; Wed, 12 Feb 2014 12:39:22 -0800 (PST)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93])
by ietfa.amsl.com (Postfix) with ESMTP id A2E981A06DE for <dane@ietf.org>;
Wed, 12 Feb 2014 12:39:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com;
l=2628; q=dns/txt; s=iport; t=1392237560; x=1393447160;
h=message-id:date:from:mime-version:to:subject:references: in-reply-to:content-transfer-encoding;
bh=5RKQiqtmUa+hLV3A6nv5fceFISTU3bJlP+6IDDpIo5M=;
b=L28B/iPv5859xw1QLJYXn3ewqvQw0vfyIC3Szf92DrPKYco/cM8wm/LA
1K6Ks2lkpemMVrBLl93oyEUmEy4IfWKenXeLC0l3lidZ+JZvjhq55uIi8
W2V0gxIMPAkpov7AWqi380TzF5ol3jGjWPL60OF7L0fPyBMmOtKqx0yJ5 U=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AmQJALDb+1KtJV2Y/2dsb2JhbABagww4V6gXA5cUgRkWdIIlAQEBAwEyAUUGCwsYCRYPCQMCAQIBRQYNBgIBAYd5CMh0F44UMjoWhCIEiRA4jmKSIYNNggo
X-IronPort-AV: E=Sophos;i="4.95,834,1384300800"; d="scan'208";a="19979348"
Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by
alln-iport-6.cisco.com with ESMTP; 12 Feb 2014 20:39:19 +0000
Received: from xhc-rcd-x05.cisco.com (xhc-rcd-x05.cisco.com [173.37.183.79])
by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id s1CKdJ1m008071
(version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for
<dane@ietf.org>; Wed, 12 Feb 2014 20:39:19 GMT
Received: from jack.cisco.com (64.101.72.76) by xhc-rcd-x05.cisco.com
(173.37.183.79) with Microsoft SMTP Server (TLS) id 14.3.123.3;
Wed, 12 Feb 2014 14:39:19 -0600
Message-ID: <52FBDBF6.5080309@cisco.com>
Date: Wed, 12 Feb 2014 13:39:18 -0700
From: Matt Miller <mamille2@cisco.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
rv:24.0) Gecko/20100101 Thunderbird/24.3.0
MIME-Version: 1.0
To: <dane@ietf.org>
References: <20140211221320.30490.31053.idtracker@ietfa.amsl.com>
<52FAA17F.3060703@cisco.com> <20140211233403.GV278@mournblade.imrryr.org>
<52FBB013.2080502@cisco.com> <20140212195413.GG278@mournblade.imrryr.org>
In-Reply-To: <20140212195413.GG278@mournblade.imrryr.org>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Originating-IP: [64.101.72.76]
Subject: Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>,
<mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>,
<mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Feb 2014 20:39:25 -0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 2/12/14, 12:54 PM, Viktor Dukhovni wrote: > On Wed, Feb 12, 2014 at 10:32:03AM -0700, Matt Miller wrote: > >>> DANE-EE(3) CU records need to have meaningful semantics for the >>> publisher. For example for a publisher to use the same >>> certificate for many SRV hosts or without worrying about using >>> a matching name, the use of non-use of name checks must be >>> specified precisely. > >>> Therefore I would suggest that the "MAY be ignored" in the >>> second paragraph of section 5, should be changed to "MUST be >>> ignored". Otherwise, the published TLSA records have unknown >>> semantics. >> >> Thank you for the feedback, Viktor. These comments make sense to >> me. We'll try to get an update out before the cutoff to address >> them. > > Thanks. You could mention that both name checks and key usage are > effectively handled by the TLSA record for DANE-EE(3). The TLSA > record binds the certificate or public key to the requested port > and protocol at the TLSA base domain, the binding is clearly for a > TLS server, so there is an implicit key usage of TLS server. > Finally, the RRSIG expiration date sets the expiration time of the > TLSA "pseudo-certificate". A requirement to ignore the > certificate content gives the publisher flexibility (e.g. same > certificate for multiple SRV hosts, ...). > Section 5 (after I change the "MAY" to a "MUST") already states that matching a DANE-EE(3) TLSA bypasses the rest of the certificate checks (paragraph 2), but the current wording might be too clumsy. I'll see what I can wordsmith to make it more explicit. I could also add something about the RRSIG expiration, but isn't that already covered by RFC4035 § 5.3.1 (bullet 5)? > There will be some overlap between the SRV draft and the SMTP > draft. I expect that's not a problem, provided they agree. > - -- - - m&m Matt Miller < mamille2@cisco.com > Cisco Systems, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - https://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCgAGBQJS+9v2AAoJEDWi+S0W7cO1vDcH/0JiXQus5YsClSbmhjT3/DbR ILJiUcKYY79yJ1bKDdcsTPF8TaNTuTDN/wtK/ABMfoggD76pJaQ0iCyQLTaL/J61 pkshzeWBKqm2kyfgrwV2hRMOxSsGBc7jWZlrBnHwkOcsxXspJCAFwYUI8X7gzbWc 1L1TCN2+7NCyPz00oj9V7fRN3mDkVFfHPwfI7X87ZihO3dbGA4HSm/DttAmrxbvY xgk7RUOznaW5SHXU6fRxeWb2DEXsYaPRmrxckauEuI8h52zjszBbAfyOr1XcRG3m eLHqpLs1yiNQ5x9cqdPHwvm/OhXqDc+BrAftsDrsgMq/Saqb47Q3w0a2vwp6cYM= =4HNk -----END PGP SIGNATURE-----
- [dane] I-D Action: draft-ietf-dane-srv-04.txt internet-drafts
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Matt Miller
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Viktor Dukhovni
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Matt Miller
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Viktor Dukhovni
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Olle E. Johansson
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Matt Miller
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Viktor Dukhovni
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Martin Rex
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Viktor Dukhovni
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Martin Rex
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Viktor Dukhovni
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Martin Rex
- Re: [dane] I-D Action: draft-ietf-dane-srv-04.txt Viktor Dukhovni
- [dane] DANE-TA(3) and DANE-TA(2) certificate cont… Viktor Dukhovni