Re: [keyassure] I-D Action:draft-ietf-dane-protocol-04.txt

[Ben Laurie <[e-mail]>]

On 22 February 2011 01:01, Stephen Kent <[e-mail]> wrote:
>> ...
>>  >
>>>
>>>  I agree that the info in the record could be a TA, and not a CA, but not
>>> if
>>>  the format of the data is an X.509 cert.
>>
>> You said a minute ago: "if you issue an X.509 cert under which other
>> certs will be validated,
>> you are a CA."
>
> yep.
>
>> This sounds correct to me. However, mostly what's being done here is
>> _not_ the issuing of X.509 certs under which other certs will be
>> validated (though it is an option), so most times the zone operator is
>> not a CA.
>
> I though one option was to place a cert in the DNS and use it as the
> basis for validating a cert chain that terminates at the EE cert for the
> web site.  If so, then that cert is used to validate other certs and
> it would generally be viewed as a CA cert.  I admit that some ambiguity
> arises when the cert is viewed as a TA. The ambiguity arises because In
> general,
> if you issue a cert, you are a CA

Eh? If I make a self-signed cert, am I a CA?

If I publish an EE cert issued by someone else, am I a CA?

Presumably at least one of these is a "no", so the zone operator is
not necessarily a CA. This was my point.

>, but when a cert used to convey TA data,
> an RP may elect to not check all of the data.
>
> We do have TA format standards that make it clear what data is to be checked
> and it might be preferable to use them, vs. a self-signed cert (although the
> later option might minimize code reuse).
>
>> In any case it does seem worth making clear when we are talking about
>> a PKIX CA vs. any other kind.
>
> It's really  not a "PKIX CA" per se; it's an X.509 CA.
>
>>  > Also, will not performing PoP be a
>>>
>>>  good outcome?
>>
>> What would be the point of proving to myself that I own a key?
>
> It would not be useful to you, but rather to someone who puts it in a
> DNS record, if that someone does so on your behalf. Otherwise that entity
> does not know if the public key really is yours.  But, I don't know that
> this results in a vulnerability for the DANE context.

Ah. If I am asking someone else to update DNS for me, then indeed a
PoP might be appropriate. But surely that's an issue for whatever
protocol I am using for speaking with my DNS provider?

>
> Steve
>