Re: [keyassure] TLSA record does not mandate the given certificate

[Zack Weinberg <[e-mail]>]

On Mon, Mar 28, 2011 at 6:27 PM, Jay Daley <[e-mail]> wrote:
>>> 1.  How is the current text in 3. not good enough?
>>>
>>> "If a match between one of the certificate association(s) and the
>>>   server's end entity certificate in TLS is found, the TLS client
>>>   continues the TLS handshake.  If no match between the usable
>>>   certificate association(s) and the server's end entity certificate in
>>>   TLS is found, the TLS client MUST abort the handshake with an
>>>   "access_denied" error."
>>
>> Only in being more confusing than I would like.  I think it's vital to
>> be crystal clear how a client should behave in all cases.
>
> Sorry to be a pain, but I struggle to see how this is confusing.  Can you explain?

Had to think about it for a while, but my big problem with it is the
"match between one of the certificate associations and the end entity
certificate" language.   An _association_ is a weird thing to _match_.

There is also a jumble of MUST-language and non-MUST language in here
("the TLS client continues" versus "the TLS client MUST abort".

>>> "A DANE client must determine whether the certificate bundle provided in the TLS handshake from a server found at a domain name matches a trusted TLSA record for that domain name.  If it does not ..."
>>
>> I changed the terminology (see text above this),
>
> I'm not sure what you are referring to.  Did I miss some text?

The "definitions" section in my proposal.  The way you'd say this in
my language is

   ... must determine whether the server's certificate bundle ... can
be associated with the
   server's domain name by at least one of the TLSA records for that
domain name ...

Note how the TLSA record is not itself an "association", it's just a
"record", whose effect is to _match_ one of the certificates in the
in-band bundle, and thus form an association between the bundle and
the _name_.

In my next draft, having taken on board some of Paul Wouters'
comments, I think I'll say that the association is between the
_server_ and the name.

zw