Re: [dane] Behavior in the face of no answer?

[Adam Langley <[e-mail]>]

On Fri, May 4, 2012 at 12:08 PM, Eric Rescorla <[e-mail]> wrote:
> Before we discuss how to proceed, I think it would be useful to get agreement
> on the security analysis. I claim that for Usages 0 and 1, treating
> TLSA non-response
> as if no TLSA records exist means that DANE adds minmal/no security
> value for those
> usages.

I believe that you're completely correct.

Browsers are not going to enable DANE hard fail in the short or medium
term because of the fraction of clients that have broken DNS and can't
fetch the records.

Therefore, browsers are not going to see a security benefit from DANE.
The DNSSEC stapled certificates that Tom points to are addressing a
very different use case: people who would otherwise use self-signed
certificates and who get annoyed that we throw errors for them.

However, browsers are not the world. Other clients, which may benefit
from a smaller, more controlled, deployment may be able to enforce
DANE hard-fail and see security benefits.

I would personally suggest that the spec requires hard fail, or at
least discusses the fact that, without hard-fail, the security
benefits are moot. Implementations frequently ignore requirements in
specs, but rarely add to them!


Cheers

AGL

-- 
Adam Langley [e-mail] http://www.imperialviolet.org