IETF Logo Mail Archive

Re: [TLS] Consensus Call on draft-ietf-tls-dnssec-chain-extension

Viktor Dukhovni <ietf-dane@dukhovni.org> Wed, 18 April 2018 20:56 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3369B127909 for <tls@ietfa.amsl.com>; Wed, 18 Apr 2018 13:56:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.201
X-Spam-Level:
X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4urY432aKX6u for <tls@ietfa.amsl.com>; Wed, 18 Apr 2018 13:56:40 -0700 (PDT)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6780126C3D for <tls@ietf.org>; Wed, 18 Apr 2018 13:56:40 -0700 (PDT)
Received: from [10.200.0.109] (unknown [8.2.105.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 1CA4E7A3309 for <tls@ietf.org>; Wed, 18 Apr 2018 20:56:40 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\))
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <CAL02cgQAA6ktnkPwaCKsrzi9tYrs3ELcW6KG=UfM43iO5smdEA@mail.gmail.com>
Date: Wed, 18 Apr 2018 16:56:39 -0400
Content-Transfer-Encoding: quoted-printable
Reply-To: TLS WG <tls@ietf.org>
Message-Id: <BBFCA54E-3059-48A8-AB5C-60F1BACA3F3A@dukhovni.org>
References: <CAOgPGoAhzEtxpW5mzmkf2kv3AcugNy0dAzhvpaqrTSuMSqWqfw@mail.gmail.com> <CAOgPGoCbHzuAZra5+i647gtLbR9ZV0-nEE+A7K6e8cUMNjNYtA@mail.gmail.com> <alpine.LRH.2.21.1804181640480.29344@bofh.nohats.ca> <CAL02cgSQbvyXuekd7x_g0DHcxYmfsydKXGDs6EQwuX5ScPYucQ@mail.gmail.com> <81405A7A-B7DC-45B1-8F7C-B96D3FD121AE@dukhovni.org> <CAL02cgQAA6ktnkPwaCKsrzi9tYrs3ELcW6KG=UfM43iO5smdEA@mail.gmail.com>
To: TLS WG <tls@ietf.org>
X-Mailer: Apple Mail (2.3445.6.18)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/HLxZJdDASa9a9ItzqUNUVQ9A7es>
Subject: Re: [TLS] Consensus Call on draft-ietf-tls-dnssec-chain-extension
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Apr 2018 20:56:42 -0000


> On Apr 18, 2018, at 4:52 PM, Richard Barnes <rlb@ipv.sx> wrote:
> 
> Secondary point.  Still don't think we should deliberately include undefined fields, e.g., because part of the discussion is whether 16 bits is the right size.

16 bits is clearly enough.  If the units are hours that gets you ~7.5 years.  Pinning for less than an hour is pointless, it then becomes smaller than typical DNS TTLs for the TLSA  RRset the client got previously, which it can cache without any pinning.

Pinning for more than 7.5 years is absurd, it only protect clients that connect less than twice per decade...

-- 
	Viktor.

v2.15.0 | Report a Bug | By Email