Re: [TLS] draft-ietf-tls-dnssec-chain-extensions security considerations

Eric Rescorla <ekr@rtfm.com> Thu, 05 July 2018 03:43 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 605C7130E87 for <tls@ietfa.amsl.com>; Wed, 4 Jul 2018 20:43:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.909
X-Spam-Level:
X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYn5vfadj6Yd for <tls@ietfa.amsl.com>; Wed, 4 Jul 2018 20:43:20 -0700 (PDT)
Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46E67130E7B for <tls@ietf.org>; Wed, 4 Jul 2018 20:43:20 -0700 (PDT)
Received: by mail-yw0-x236.google.com with SMTP id l189-v6so2492329ywb.10 for <tls@ietf.org>; Wed, 04 Jul 2018 20:43:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=mMaOt6a+8gJjY81yNtxbnW0r1n2uE8kXwlqEKjHoNLA=; b=Jql6HwkzyKFv8j+9Si9FpN+z9eZpfH1RWpJIWC2w1HTEMkNFhxSiOySpug77FR8xRp GZHq7HGXa9DH+yfB45hqzbV0WCfEbar4VLXGd3P5XZNoFgQlYw2m2Are91gu3Ls30NxZ Pm8NBA9lqy3BAHJNqPJDWBKrvQ4I6w1Mbrh/rf9uaZrQhgTv8TkeAvUKcyY1OlNqUtex Lj21iC52fe6vPugHgbaOwiPs1/a4wV4xh9MmF9+zYTEWLVq8/9AZoG7oEkiiJyIETyaZ 3TbI2GQdpPGpcGf3UVIlEKmrjpGg3rfv2pna/YNJOOacO6aBPSNfIwFsDhIr7f2c5a1Z 03Pw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=mMaOt6a+8gJjY81yNtxbnW0r1n2uE8kXwlqEKjHoNLA=; b=nnKG48BlAdFDOGYbyueAeM4LR7QCNwVBKtyobLjnstkhTcHe2uz4cjb3xuqrmIBJT3 Jq8iKg5wQefizsul9QehCc1bNykb23xdR8OC2FUgdFp1QexIo0vJgIAhm88ojCNm+RUH ykZZNpcZnKtAJmaG0O4c49MsP8js+P6anqwKUo/aryf3qbRDJt/5D53Acvok2gUspCoH Ys7bb69bmRvMTDgPcltn5m9GyVz/D3iRsCIML9om+vgBIM+ePm0CyXMye62lpI4QPUhb n3HQBDTWx3vQfR5qLDes1iT2wN1mjk9kDuRGJu/N46ju2FpNXTqH5H3hW8jQ0YfdTxaY TqhQ==
X-Gm-Message-State: APt69E042yBS+GWPWkMhLK4lY4zUmb9k4xAqkrhpbf4uzxYH7NJGgryp sVkUOhdovOtTPL5FeeHFjCfx+H41WMFDlfRnnmESM797
X-Google-Smtp-Source: AAOMgpdTDtx/qOgvqXDJk8iW/+tBwXWVx4DiAip6ZhIM5pCqmfwE02m3qdBQJH7WvYW4CULd1Qd0YiJ6MKhYNY6qDsE=
X-Received: by 2002:a81:3e02:: with SMTP id l2-v6mr2137892ywa.381.1530762199282; Wed, 04 Jul 2018 20:43:19 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a81:6b83:0:0:0:0:0 with HTTP; Wed, 4 Jul 2018 20:42:38 -0700 (PDT)
In-Reply-To: <20180705031615.GO85096@straasha.imrryr.org>
References: <20180604203947.GW13834@akamai.com> <alpine.LRH.2.21.1806050858340.8057@bofh.nohats.ca> <CAOgPGoBPfL46ogCGa4tSA2q9dikuTwrY766R5y3U-DD1k+XudQ@mail.gmail.com> <CABcZeBOQ0AueZup+sLbK1g2nJ_GUP5Oq+pzRaKmQ0y=Foa4-MA@mail.gmail.com> <20180705023310.GL85096@straasha.imrryr.org> <CABcZeBMDKeYM_jnB+2hNREHOLNwOpMAfm1E69hbGdmZMFBCMRw@mail.gmail.com> <20180705031615.GO85096@straasha.imrryr.org>
From: Eric Rescorla <ekr@rtfm.com>
Date: Wed, 4 Jul 2018 20:42:38 -0700
Message-ID: <CABcZeBOpXpAYO8EBgn=brhd8H0PM_XR63JSBTB0+k88mKxrnBg@mail.gmail.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000001fd1ee057038595e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/4_9_kOKQE2d6OrFhLB26BBSW9wQ>
Subject: Re: [TLS] draft-ietf-tls-dnssec-chain-extensions security considerations
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Jul 2018 03:43:23 -0000

On Wed, Jul 4, 2018 at 8:16 PM, Viktor Dukhovni <ietf-dane@dukhovni.org>;
wrote:

> On Wed, Jul 04, 2018 at 07:46:13PM -0700, Eric Rescorla wrote:
>
> > > > Do we have a count of major implementors who say they will do so?
> > >
> > > Well, what is a "major implementation"?
> >
> > Well, we could start with "what implementations are going to do this"?
>
> Since Postfix supports not just MTA-to-MTA SMTP, but also SUBMIT,
> and I am a maintainer of both the TLS features in Postfix, and the
> X.509 code in OpenSSL, I expect to add support for DANE chain in
> OpenSSL and Postfix in 2019.  Next on the list would be Dovecot and
> mutt, but it'd be nice if that was done by one of the primary
> maintainers of those packages.
>

It would be nice to hear from those maintainers, as well as from some of
the bigger email senders (e.g., GMail, Yahoo Mail, etc.)


> Yes, and this is where grease comes in. Specifically, if implementations
> > are required to send empty values (or zero) until something is specified,
> > then implementations which *require* those values and choke otherwise go
> > undetected.
>
> Any broken clients will get fixed.  The client that motivated this
> draft is purported to require the extension, and the others will
> take some time to appear, highly likely not until the follow-on
> spec is written.  The odds of real problems here are negligible.
>

It has not been my experience or, I think, that of the WG, that this is the
case. Rather, once there is a significant fielded population of intolerant
endpoints, generating the offending PDU causes too much breakage and
instead you have to send something which doesn't break those endpoints. cf.
the padding extension, supported_versions, and the CCS hack.


> any case, as Martin Thomson says, we have a perfectly good extension
> > mechanism which can be used to add pinning later without creating any
> > placeholder here.
>
> At much too much complexity, unless we fork-lift this extension
> plus the additional payload, and largely obsolete this draft.  Using
> one extension to pin itself and another is much too cumbersome.
>

Yes, I appreciate that this is your opinion.

-Ekr