[Ntp] Antw: Re: Antw: [EXT] Re: Wildcards in NTS certificate checking

Hi!

Well actually the whole discussion is more about "clarity" (of specification)
rather than about "security".
Some time ago I was bitten myself by a change in Firefox when it stopped to
use the CN of a host certificate to match the host name (as years before), but
insisted that the hostname is present in subject's alternate name(s).

So maybe make clear what works, and what won't. Maybe add an explanation why
(what the policy decisions had in mind).

As mentioned the mechanism matching the certificates with host names or
addresses is most important (it decides whether wildcards will work or not).

Regards,
Ulrich

>>> Hal Murray <halmurray+ietf@sonic.net> schrieb am 19.04.2022 um 22:32 in
Nachricht
<20220419203203.1FAFC28C1CA@107-137-68-211.lightspeed.sntcca.sbcglobal.net>:

> dfoxfranke@gmail.com said:
>> Absent any specific arrangement with its clients to the contrary, the
server
>> is free to use wildcard certificates and to change certificates at any
time.
>> The client is free to pin certificates or to prohibit wildcards, but,
absent
>> any specific arrangement with the server operator to the contrary, should
>> anticipate that this will lead to sudden breakage that it will be
incumbent
>> on the user to debug. Having this as a default does not make for a good
user
>> experience. 
> 
> Good point.  But what about people who are willing to work a bit for better

> security?  Would they even use NTS, or would they all install a GPS box 
> inside 
> their firewall?
> 
> What is the target audience?  Do we have more than one?
> 
> Should we be collecting ideas for a BCP?
> 
> What are the units of (in)security?  How do we even discuss how much feature

> X 
> adds to security?
> 
> Here is one to think about...  You don't want all of your servers using the

> same CA.
> 
> 
> ‑‑ 
> These are my opinions.  I hate spam.
> 
> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 