Re: [keyassure] Bare keys again

[Jeff Schmidt <[e-mail]>]

I'm new here, so I please accept all relevant apologies and I ask for all relevant leniance and guidance.  

On Mon, 21 Mar 2011, Paul Wouters wrote

> http://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion

> This is another clear signal that DANE is needed, and the need for the
> X509 storage format is unneccessary. So people can simply take control
> of SSL for servers within their own DNS zones.

I have been tracking this conversation with interest.  I am of the opinion that X.509 is an artifact of the past, when public keys were distributed outside of any useful namespace, and we needed additional "stuff" to establish provenance, chain of trust, etc.  X.509 is essentially a way to (1) map a public key to a hostname/email address, and (2) establish a chain of trust.

Of course, we don't need (1) when the key is in DNS, and hopefully we're moving away from practices that would need (2) for all the reasons the CA trust model is broken.  So, X.509 brings a lot of overhead/baggage without providing anything useful in return.(*)  Thus, I agree that we should be designing DANE (and other approaches) for the future, which will hopefully be a post-X.509/CA world.

The (*) is interoperability with TLS, which we obviously need.  So, here's the idea: why don't we design DANE to support both methods of operation: publishing X.509 certs/hashes and bare keys.  This gives us interoperability in the near term and flexibility into the future (to combat the TXT approaches).

As I see it, we could generalize the "TLSA Certificate Types" registry to support several methods of operation - something like "TLSA Data Types" then add to the initial registry:
   n: Bare public key to identify an end entity
   n: Bare public key trust anchor

Hash types still applies as written; some other language would need smoothing here and there, but it pretty much works.

If I'm not way off base here, I'd be happy to take a shot at some edits to -06 if desired.

Thanks,
Jeff