IETF Logo Mail Archive

Re: [DNSOP] [Ext] Call for Adoption: draft-hoffman-dnssec-iana-cons

Paul Wouters <paul@nohats.ca> Wed, 06 January 2021 22:15 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 007B33A133A for <dnsop@ietfa.amsl.com>; Wed, 6 Jan 2021 14:15:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gcBQd4bcJhaq for <dnsop@ietfa.amsl.com>; Wed, 6 Jan 2021 14:15:48 -0800 (PST)
Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE1DA3A12B5 for <dnsop@ietf.org>; Wed, 6 Jan 2021 14:15:48 -0800 (PST)
Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 4DB3bR36P3z6D; Wed, 6 Jan 2021 23:15:47 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1609971347; bh=XYFCekwR/uMmrBv5vxpat/6RQegouOFL4iqZpvLh0Xc=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=cmYkwtbQU3cdphawXUwDI4C43EIWXb3Q+0G819y5jZk8Nx36zqDQnKU5kSysBjs+X VFv3V9wbyTiLSNQYmMLK5BdL+SOP6xAWbgDp8TGieiww6Xadalc8hKV694tJ7iO9gi iZVp3/4/6so+9wGxek3HvwevGp82pjlQNvZXkVWE=
X-Virus-Scanned: amavisd-new at mx.nohats.ca
Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id Ms43Y5fe3pPj; Wed, 6 Jan 2021 23:15:46 +0100 (CET)
Received: from bofh.nohats.ca (bofh.nohats.ca [193.110.157.194]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 6 Jan 2021 23:15:46 +0100 (CET)
Received: from [193.110.157.220] (unknown [193.110.157.220]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 3E7706029A47; Wed, 6 Jan 2021 17:15:45 -0500 (EST)
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
From: Paul Wouters <paul@nohats.ca>
Mime-Version: 1.0 (1.0)
Date: Wed, 06 Jan 2021 17:15:44 -0500
Message-Id: <D5AB5A90-6E47-4535-8614-CDF132E131DF@nohats.ca>
References: <CABcZeBNi=RzB6=Yz2oXsjqvo30d9bqDYeicp0==K65iJ8E9qGg@mail.gmail.com>
Cc: Paul Hoffman <paul.hoffman@icann.org>, dnsop <dnsop@ietf.org>
In-Reply-To: <CABcZeBNi=RzB6=Yz2oXsjqvo30d9bqDYeicp0==K65iJ8E9qGg@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
X-Mailer: iPhone Mail (18C66)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/ly-plNbdleGpgAUigtLdjHhrCJA>
Subject: Re: [DNSOP] [Ext] Call for Adoption: draft-hoffman-dnssec-iana-cons
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 06 Jan 2021 22:15:50 -0000

On Jan 6, 2021, at 17:01, Eric Rescorla <ekr@rtfm.com> wrote:
> 
> 
> This is not strictly correct: TLS allows both the client and the server to advertise their supported signature algorithms, which can be used by the peer to guide certificate selection.

How common is it for TLS servers to have multiple signature algorithm / certificates configured to support this?

For you IPsec, which has a similar issue, I have never seen a server configured with two certificates, eg to use RSA or ECDSA, or seen opensource software supporting this.

Paul

v2.46.0 | Report a Bug | By Email | System Status