Re: IAB agendas now public

[Viktor Dukhovni <[e-mail]>]

> On Sep 5, 2018, at 12:30 PM, Phillip Hallam-Baker <[e-mail]> wrote:
> 
> Meanwhile we have had DANE throw in a service description attribute record but only for one transport protocol and only for one trust model and even though it has seen precisely zero adoption in the WebPKI world, it is apparently the only security policy approach we are permitted to consider.

By WebPKI world, I assume you mean web browsers using HTTPS?

DANE *has* seen adoption in SMTP (~314,000 domains presently),
with implementations in multiple MTAs: Postfix, Exim,
MailChannels, Halon, PowerMTA (beta), Cisco ESA (beta), ...

For the Web, the main obstacle is last-mile DNSSEC issues, which
may get easier as DNS over TLS and DNS over HTTP offerings from
Cloudflare and the like eliminate bypass the CPE DNS breakage.
The remaining obstacle is purportedly latency, which may be
addressed with tls-dnssec-chain, if we manage to get adequate
downgrade-protection into the spec.  Finally, DNSSEC adoption
is still light, at ~9.5 million domains, highly concentrated in
Northern Europe, the USA and Brazil.  The actual payload of DANE
TLSA record has not been a real barrier to adoption.  The
PKIX-TA(0) certificate usage is a reasonable candidate for
hardening HTTPS against rogue CAs.

True, DANE is not "service discovery".  If a new service
discovery protocol that subsumed DANE became popular,
and vended both service location and security policy,
that'd be fine.  It is an interesting problem to work on.

-- 
	Viktor.