Re: [saag] On PKI vs. Pinning (SAAG 108 preview)

[Nico Williams <[e-mail]>]

On Fri, Aug 28, 2020 at 03:49:58PM -0400, Michael Richardson wrote:
> Nico Williams <[e-mail]> wrote:
>     > In the first two cases ...
> 
> I agree with your analysis.

I hadn't understood that those were specifically TLSA RR usage values.
So I was a bit confused, but still, I think the analysis was right.

> Do you think we need to capture it into a document?

It might be nice.  The realization that DANE is akin to a pin dist.
mechanism, that app stores and such are comparable in that sense, seems
like something that should be written down somewhere.

>     > There's one more.  draft-dukhovni-tls-dnssec-chain allows ...
> 
> I didn't know that this document exists.  To save others the step of learning
> about it:
>    ...
> 
> So, I wanted to do EXACTLY this for IPsec OE (RFC4322).

Yeah!

> I imagined two entities (Opus and Bill the Cat) sitting in a meadow, doing
> security of IPv6-LL addresses without any outside connectivity.
> [You can't expect a dead cat to fetch CRLs..]

You'd need an IKEv2 extension like Viktor's TLS extension, but which
also includes A/AAAA RRsets.

> I guess this is intended for the TLS WG?

Funny story about that.  There had been a TLS WG work item for it that
didn't support either the extension pin or the denial of existence
chain, and when we pushed for that to be added WG consensus fell apart
and the WG dropped the I-D with the agreement that all parties would get
to publish their own versions of it on the ISE.

>     > Pinning lets apps detect MITM attacks, but not whether they are
>     > tolerable attacks (enterprise proxies).
> 
> Agreed.
> That would have to come by some attestation statement in the decline.
> draft-ietf-capport-api-08 is one place I would like to that.

Tolerable attacks are essentially site-local pins that the app needs to
decide are OK or not OK, probably by hardcoding an OK/not-OK policy.

>     > In enterprise environments it's common to allow connection to banking
>     > sites through proxies w/o MITMing them.  Typically the banking sites
>     > allowed are either on some generic list (e.g., supplied by the
>     > enterprise proxy vendor), or those that the proxy's operator has
>     > reporting agreements with.
> 
> Yes.  But, generating exceptions to the site administrator to approve/deny
> might also be a good way to this.  MUD/RFC8520 statements from the app would
> also be interesting as supporting evidence.

Yes.

Nico
--