[keyassure] [dane] #23: Asserting DANE exclusivity for an entire domain

["dane issue tracker" <[e-mail]>]

#23: Asserting DANE exclusivity for an entire domain

 I would like to be able to assert DANE exclusivity for an entire domain so
 that, with respect to clients that check DANE first and fall back to a
 mainstream public CA list, a public CA cannot fabricate a TLS service I do
 not offer.

 Previously discussed in [http://www.ietf.org/mail-
 archive/web/keyassure/current/msg01641.html this thread], but no final
 decision was reached.

 One approach to achieve this is to compose (1) a means of asserting the
 nonexistence of a TLS service at a (hostname, transport, port) triple and
 (2) a means of applying such an assertion to an entire domain except where
 otherwise specified.  Zack Weinberg made a reasonable proposal for (1):
 use a single RR with "certificate type" 0 and no "certificate for
 association".  (2) can be done with DNSSEC wildcards, but that is a little
 messy and will seriously bloat the zone if several different RRtypes each
 require this treatment.

-- 
------------------------------------+---------------------------------------
 Reporter:  matt@…                  |       Owner:     
     Type:  enhancement             |      Status:  new
 Priority:  major                   |   Milestone:     
Component:  protocol                |     Version:     
 Severity:  -                       |    Keywords:     
------------------------------------+---------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/23>
dane <http://tools.ietf.org/dane/>