Re: Review of draft-saintandre-tls-server-id-check

[Stefan Santesson <[e-mail]>]

On 10-09-08 9:53 PM, "Shumon Huque" <[e-mail]> wrote:

>> If the "reference identifier" is  _Service.Name then the match is being done
>> on the *input* to the SRV lookup process, not the output, and prohibition on
>> DNS lookups would not apply (or even make any sense).
> 
> Yes.
> 
> The output of the SRV record lookup contains a target hostname,
> not a service name, so it's not applicable to the SRVName name
> form. The target could be used in another name form (dNSName)
> as the reference identifier, but then the client needs to convince
> itself that the lookup was done securely (DNSSEC or some other
> means) otherwise there's a security problem.

I disagree,

A client can use the output from the DNS lookup also from a normal insecure
DNS server.

The only thing the client need to do is to verify that the domain name
provided in the input to the lookup matches the host names provided in the
output. It can then safely use the host names in the SRV record as reference
identifiers IF the SRV-ID in the server certificate matches the the
reference identifier.

A false host represented by a false identifier from a bad DNS server will
not be able to present a trusted certificate that supports it's claim to be
an authorized provider of the requested service for the domain in question.

/Stefan