Re: (short version) Re: Last Call: <draft-faltstrom-uri-10.txt> (The Uniform Resource Identifier (URI) DNS Resource Record) to Proposed Standard

Viktor Dukhovni <> Fri, 27 February 2015 18:27 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 9D40E1A9123 for <>; Fri, 27 Feb 2015 10:27:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id LDjp2FvUw6iI for <>; Fri, 27 Feb 2015 10:27:08 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 1ED301A9176 for <>; Fri, 27 Feb 2015 10:27:08 -0800 (PST)
Received: by (Postfix, from userid 1034) id 47B21282FC0; Fri, 27 Feb 2015 18:27:07 +0000 (UTC)
Date: Fri, 27 Feb 2015 18:27:07 +0000
From: Viktor Dukhovni <>
Subject: Re: (short version) Re: Last Call: <draft-faltstrom-uri-10.txt> (The Uniform Resource Identifier (URI) DNS Resource Record) to Proposed Standard
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <>
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 27 Feb 2015 18:27:09 -0000

On Fri, Feb 27, 2015 at 10:46:12AM -0600, Nico Williams wrote:

> I would much prefer a Standards-Track document that says to
> authenticate the origin domainname as follows:
>  - use DNSSEC for all DNS queries needed to find the URI RRs and DANE
> to authenticate the authorities of the resulting URIs
> or
>  - expect the target authorities to have certificates that
> authenticate the origin, using SNI if need be.
> I would still drop everything related to NAPTR and DDDS.

That works for me, and is in reasonable alignment with


which ignoring the gory details says essentially the same thing,
but with the choice made dynamically, based on presence of "secure"
SRV and TLSA RRsets, rather than as a static prior dichotomy.

I am also fine with the informational variant.  Either way, perhaps
an informational reference to the DANE SRV draft would be helpful.

As an instigator of the security sub-discussion, I just wanted to
make sure than the document did not claim that introducing indirection
into HTTPS has minor security consequences.  Rather it is a significant
change in the threat analysis for any application that makes the switch.

Likely there are existing applications that have glossed over this
issue (going through the motions) with MX and SRV records, but any
such poor practices are not IMHO sufficient grounds to say that
the current text's security considerations match the scope of the
proposed semantics.

And I still support the proposed semantics, just with eyes wide
open to the security implications.