Re: [dane] Behavior in the face of no answer?

[John Gilmore <[e-mail]>]

> responses being sent to the user.  Thus, in order to achieve any
> security benefit from certificate usage 0 or 1, the protocol requires
> that when DNS responses have not arrived or are not valid, the TLS
> connection must not succeed.

It's easy for a Man in the Middle to subvert cert usage 3 this way
too.  They just issue themselves a cert signed by some subverted
public CA, block your TLSA DNS responses, and then if you proceed with
TLS, you'll accept the key signed by the subverted public CA, since
you never saw the record that says "This server is secured by THIS
PUBLIC KEY RIGHT HERE, and not anything else."

This attack also works against cert usage 2.  Thus I'm not sure why
this proposed graf even mentions cert usages 0 and 1, except perhaps
to remind the PKIX fans among us that proceeding in the face of DNS
blockage causes even their favorite forms of TLSA to be vulnerable.

Thus I'd revise that text (for a security section somewhere) to:

An attacker who is able to divert a user to a server under his control
is also likely to be able to block DNS requests from the user or DNS
responses being sent to the user.  Thus, in order to achieve any
security benefit from DANE TLSA, the protocol requires that when DNS
responses have not arrived or are not valid, the TLS connection must
not succeed.

	John