Re: [keyassure] Bare keys again

[Matt McCutchen <[e-mail]>]

On Sun, 2011-03-20 at 20:40 -0400, Paul Wouters wrote:
> On Sun, 20 Mar 2011, Paul Hoffman wrote:
> > If you want to add bare CA keys, that's fine, but I suspect that you actually want to add bare end entity keys, and RFC 6066 doesn't allow that.
> 
> That difference is muddy anyway, isn't it? Isn't a self-signed certificate a CA?

It is not used to sign any certificates (except itself, but that is
irrelevant because no one ever relies on the self signature), so no.

> > If you are truly interested in bare CA keys, we can make that change if the WG wants. However, I have heard no interest in bare CA keys from anyone (including you) before today; all of the discussion of bare keys was for end entity keys. For that, I believe you actually need to write an extension to TLS.
> 
> We are talking about end entity keys.
> 
> The client sends its hello message saying "I have all the CA root trust
> anchors I need from pre-agreement".  Whether that means it got information
> from DNSSEC/DANE or elsewhere does not matter. What matters is, is that
> the client can start the TLS handshake without the server sending any
> PKIX certs.

How does this look at the message level?  The server sends a Certificate
message containing a zero-length sequence of certificates?  This is not
at all what is envisioned by RFC 6066.  To say that your scheme involves
no TLS protocol changes is a little misleading: you are using existing
messages but dramatically repurposing them.  IMO, this scheme should be
standardized and subjected to the attendant level of scrutiny before we
consider supporting it in DANE.

-- 
Matt