IETF Logo Mail Archive

Re: [keyassure] Bare keys again

Paul Wouters <paul@xelerance.com> Wed, 23 March 2011 10:29 UTC

Return-Path: <paul@xelerance.com>
X-Original-To: keyassure@core3.amsl.com
Delivered-To: keyassure@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD4673A67F9 for <keyassure@core3.amsl.com>; Wed, 23 Mar 2011 03:29:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.592
X-Spam-Level:
X-Spam-Status: No, score=-2.592 tagged_above=-999 required=5 tests=[AWL=0.007, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qlGWnTMlfKt4 for <keyassure@core3.amsl.com>; Wed, 23 Mar 2011 03:29:05 -0700 (PDT)
Received: from newtla.xelerance.com (newtla.xelerance.com [193.110.157.143]) by core3.amsl.com (Postfix) with ESMTP id 6D5713A67F3 for <keyassure@ietf.org>; Wed, 23 Mar 2011 03:29:05 -0700 (PDT)
Received: from tla.xelerance.com (tla.xelerance.com [193.110.157.130]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by newtla.xelerance.com (Postfix) with ESMTP id DE68BC582 for <keyassure@ietf.org>; Wed, 23 Mar 2011 06:30:35 -0400 (EDT)
Date: Wed, 23 Mar 2011 06:30:35 -0400
From: Paul Wouters <paul@xelerance.com>
To: keyassure@ietf.org
In-Reply-To: <alpine.LFD.1.10.1103211727150.28224@newtla.xelerance.com>
Message-ID: <alpine.LFD.1.10.1103230625150.18330@newtla.xelerance.com>
References: <92D68A5E-5CB7-4C80-8D7B-0B8D55D93608@kumari.net> <alpine.LFD.1.10.1103201932370.20162@newtla.xelerance.com> <9D285351-8D73-4C15-BE2C-5DF731C08DCE@vpnc.org> <alpine.LFD.1.10.1103202028110.20162@newtla.xelerance.com> <1300669586.2117.12.camel@localhost> <alpine.LFD.1.10.1103202211390.20162@newtla.xelerance.com> <1300739370.2117.40.camel@localhost> <alpine.LFD.1.10.1103211631260.20162@newtla.xelerance.com> <AANLkTimyOXv66UeG2q2dmt1-e_Ek6WPPH-coueFc7fDS@mail.gmail.com> <AANLkTin1QjUbVFN8FqjL2SPRLSRRw4Ahs4zbhy4ZdZuX@mail.gmail.com> <alpine.LFD.1.10.1103211727150.28224@newtla.xelerance.com>
User-Agent: Alpine 1.10 (LFD 962 2008-03-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Subject: Re: [keyassure] Bare keys again
X-BeenThere: keyassure@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Key Assurance With DNSSEC <keyassure.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/keyassure>, <mailto:keyassure-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/keyassure>
List-Post: <mailto:keyassure@ietf.org>
List-Help: <mailto:keyassure-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/keyassure>, <mailto:keyassure-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Mar 2011 10:29:06 -0000

On Mon, 21 Mar 2011, Paul Wouters wrote:

>> Trying to use DANE as a means of eliminating X.509 from TLS is a 
>> non-starter as far as I am concerned.
>
> That has been loud and clear. However, it does not mean others should stop 
> trying to innovate and move forward.

Especially considering the latest CA compromise where a CA issued a rogue
certificate for addons.mozilla.org. And this is not some el cheapo CA,
but one that is respected and has people very active within the IETF, the
good guys....

http://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion

This is another clear signal that DANE is needed, and the need for the
X509 storage format is unneccessary. So people can simply take control
of SSL for servers within their own DNS zones.

Paul

v2.23.0 | Report a Bug | By Email