Re: [dane] Behavior in the face of no answer?

[Eric Rescorla <[e-mail]>]

On Thu, May 3, 2012 at 3:37 PM, Andrew Sullivan <[e-mail]> wrote:
> On Thu, May 03, 2012 at 03:20:47PM -0700, Paul Hoffman wrote:
>> >From the earlier thread on this topic, I do not think there is "wide agreement" on what is and is not bogus. RFC 4033 and 4035 don't even agree about it.
>>
>
> I'm not sure I agree about this.  There is a possible difference in
> 4033 and 4035 on the meaning of "indeterminate", but I don't know
> anyone who disagrees about "bogus": you ought to be able to validate
> it, and for some reason, you can't.  Whatever the reason is, it's
> bogus.
>
> In this case, what you're talking about is "didn't get an answer".
>
>>    o  If the DNSSEC validation state on the response to the request for
>>       the TLSA RRset is bogus, or if a response is not received or the
>>       response has no data, this MUST cause TLS not to be started or,
>>       if the TLS negotiation is already in progress, MUST cause the
>>       connection to be aborted.
>
> I get the analysis, but I feel rather uncomfortable with it.  If you
> can't get responses from the DNS, surely you have other problems, to
> begin with?

Well, I absolutely have a problem.... I'm under active attack :)

However, if you choose option (a) and hard fail, then all the attacker
can do is create a failure. However, if you choose option (b) then
the attacker is able to cause you to connect to his server even
though the domain operator is trying to serve you a DNSSEC-signed
DANE record which tells you not to accept that cert (if you
could only get that record).

-Ekr