[TLS] Re: Cases against trust negotiation
Eric Rescorla <ekr@rtfm.com> Sun, 22 December 2024 04:39 UTC
Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2277C14F619 for <tls@ietfa.amsl.com>; Sat, 21 Dec 2024 20:39:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.907
X-Spam-Level:
X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20230601.gappssmtp.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JE5S-xVvgBtQ for <tls@ietfa.amsl.com>; Sat, 21 Dec 2024 20:39:03 -0800 (PST)
Received: from mail-yb1-xb2d.google.com (mail-yb1-xb2d.google.com [IPv6:2607:f8b0:4864:20::b2d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22369C14F614 for <tls@ietf.org>; Sat, 21 Dec 2024 20:39:03 -0800 (PST)
Received: by mail-yb1-xb2d.google.com with SMTP id 3f1490d57ef6-e46ac799015so2399317276.0 for <tls@ietf.org>; Sat, 21 Dec 2024 20:39:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20230601.gappssmtp.com; s=20230601; t=1734842342; x=1735447142; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Slit6XkSVOkdNvvMUKpYj6cMT2mk4Je8KuuZBnGR0uc=; b=MsKVOFo1X2+1Fa0t+O1BejPsIOnhfB7fREUQG/Mg5alJUazF0OZCI+ZQeA9wSqDzOb Ny/FOq3d+JOt9Qodc/c91pC8BqHGtTnr0qyvrZ+0FdVjrP8ZD2EfYwBb9sQs6bBtEdAw tjgdY9EAkbGil5VDqnLEedwnHPzVhsi9cTtO7jzoa8Rtwbnq02zYD9QgEn/gouYpQYwH eLdQU3SWtqjCUnWNBUkDIrWlp4p4RZg3vSQGxQuj1oRAvH7sKcfet7sV0FlAc2Bj8Cs7 sxOUw0WRW4KsgurdvMKVCpcptTQeEKlMbpTNKmOwT9j0pOKKfl4rduyf4Ta8HC0dVLal YasQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1734842342; x=1735447142; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Slit6XkSVOkdNvvMUKpYj6cMT2mk4Je8KuuZBnGR0uc=; b=tDF1qYKbQqs64irksTVOb9BgNdLufg8ZYZTjB93slP3B5PTWFwYC8dIO6taf/rC5+h XLEZBIL003bZZZBF6gAgSWVV8/7md8HFxOcRpNtbWLoMwTRQd17GBH5MZgVanW0cor26 qDy5U7I6eDtNW7o4YloJVL5dRlbohcsBJdvOnUyBrH85K8SIgQUyvBy4+orsPPferP3J Nns66yba6EoIZSI2XcFp5gcevXIISeix9EP4l6BxqIRvE4xzvOdYCKeAYZxabaCKiizf KD+5G7eIRpoORiQ4UTHEYiSx53tLYJpHZyd1E3QvRcOrfCc7X3h+O/pUyyO+MiMWtMSm oFHg==
X-Forwarded-Encrypted: i=1; AJvYcCU+l76PXTqOvBIpA4rpxM6in3Gs/t7/id2lSQXAt7XWebogdma3Gz0nzCc6rmLRbHYxKm8=@ietf.org
X-Gm-Message-State: AOJu0YwTmBBGgM/VyA072E1RHYLH5dKXAVcphNsU5kBzYsWWtplWGP+k yxHYvyik693WCot5X/fuSDKgaY3FPYnHx3JgpPB/r0/y1XDec/ECPo/w41tNciV2Si9Atus1iDG 0eBGxNx8D3IReFocsGncHvM4sbpC60EO6XK3xEA==
X-Gm-Gg: ASbGnctdBBoyFJU49U6m5P93tIfI0HG2qTE+WsNAh/BUbtYgFizPPSO0K6KUbP2ZA0R gQ+I4S4mnQDB5xKKJ05kzCLVmCSkFXAriIl4fhq1j
X-Google-Smtp-Source: AGHT+IENgaWUswDhnmixWbWIA5UqhHdWNuHqzjr9bibWAJqQGoHzIN3U9mJdRRN8XRFxZqU/DSy3NbBj6g9ieuBStlM=
X-Received: by 2002:a05:690c:688d:b0:6ef:7ac0:1ab8 with SMTP id 00721157ae682-6f3f8240e8fmr69959047b3.40.1734842341952; Sat, 21 Dec 2024 20:39:01 -0800 (PST)
MIME-Version: 1.0
References: <bd7be0f1-239e-4d45-8808-017787f9e285@betaapp.fastmail.com> <CAJTd26JFBbU26FU=vfwB_agA375RHkb5qUF23-PFCuwDYgTNmw@mail.gmail.com>
In-Reply-To: <CAJTd26JFBbU26FU=vfwB_agA375RHkb5qUF23-PFCuwDYgTNmw@mail.gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Sat, 21 Dec 2024 20:38:26 -0800
Message-ID: <CABcZeBP_7T2AY6n17z-+ZtRriTJubk3muh-zmRzsjVKMOnDF5w@mail.gmail.com>
To: Brendan McMillion <brendanmcmillion@gmail.com>
Content-Type: multipart/alternative; boundary="00000000000088ae7e0629d4759f"
Message-ID-Hash: UCMIX7ZS6JKCSKB46C7TRDMXRUCFI7IK
X-Message-ID-Hash: UCMIX7ZS6JKCSKB46C7TRDMXRUCFI7IK
X-MailFrom: ekr@rtfm.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: tls@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Cases against trust negotiation
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Jy-9Os-alkEaeu7s2tHMIbUSOXk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>
On Sat, Dec 21, 2024 at 2:09 PM Brendan McMillion < brendanmcmillion@gmail.com> wrote: > I'm not sure that this is a productive framing: "we’re really asking for a > verdict on trust negotiation as a mechanism". Trust anchor negotiation is > already deployed. It takes the form of chain building, cross signing, > These are not really trust anchor negotiation mechanisms. Rather, they are alternatives to negotiation. and/or client fingerprinting. > This isn't really a negotiation mechanism either, and I think there's fairly widespread feeling that fingerprinting is an undesirable practice. -Ekr
- [TLS] Cases against trust negotiation Martin Thomson
- [TLS] Re: Cases against trust negotiation Eric Rescorla
- [TLS] Re: Cases against trust negotiation Brendan McMillion