Re: [Ntp] Wildcards in NTS certificate checking

[Hal Murray <[e-mail]>]

[e-mail] said:
> You will not get a reputation for being insecure if you support wildcards.  I
> mean, c'mon, Marco has pointed out that the software is inconsistent and I've
> pointed out that it is really common practice and that your policy decisions
> seem based on lack of knowledge. I've also suggested other places you could
> go to (the UTA and TLS working groups).  What more do you want?  I'm can’t
> imagine how else I can useful contribute to this conversation. 

I think I've figured out where my confusion is/was coming from.  I was 
thinking of 6125bis as a modification to 6125 rather than a replacement.

You asked for feedback...

The part that I was looking for was an explicit statement that the "SHOULD NOT 
contain the wildcard" has been dropped.  It might help to add something like 
that to the 3rd bullet in section 1.2

IP Addresses are out of scope.  I'd like to know more, preferably a sentence 
or paragraph but at least a good reference.  It seems like a good way to avoid 
all the security tangles with DNS.

Last paragraph before section 4:  "MUST state" that wildcards are not 
supported.  How does that apply to existing RFCs?  Has that item been added to 
the reviewers checklist?  I think it would clarify things if future RFCs would 
state that wildcards are supported.

Section 6.2, last paragraph, matching DNS name and service type.  It's 
probably obvious, but worth stating.  If I'm trying to find a match for 
www:www.example.com or sip:voice.example.com, will that match a certificate 
for sip:www.example.com?

------

OpenSSL treats ".example.com" (leading dot) as matching x.example.com or 
x.y.example.com or x.y.x.example.com ...

Where did that come from?  Is there a good story? ...  Should it be explicitly 
deprecated?


-- 
These are my opinions.  I hate spam.