Re: [TLS] RFC 2818 wildcard rationale

["Yngve N. Pettersen (Developer Opera Software ASA)" <[e-mail]>]

On Tue, 01 May 2012 13:45:58 +0200, Chris Richardson  
<[e-mail]> wrote:

> RFC 2818 states:
>
> Names may contain the wildcard
> character * which is considered to match any single domain name
> component or component fragment. E.g., *.a.com matches foo.a.com but
> not bar.foo.a.com.
>
> I was trying to figure out the rationale behind this, but have been
> unable to do so.  I was hoping someone could enlighten me.
>
> Suppose that:
> (1): *.example.com matched a.b.example.com
> (2): *.example.com matched example.com.
>
> What security problems exist with (1) and/or (2) that are solved by
> following the rules of 2818?  Anything more than preventing a single *
> from matching the entire internet?

Regarding #1, if * matched multiple labels, it would match  
www.yourbank.com.whatever.example.com, which would be a very bad thing  
since it can mislead users into thinking that they are visiting  
"www.yourbank.com".

Regarding #2, I don't think that would introduce any real badness, except  
having to edit the rulestring, which make already complex logic more  
complex, and more likely to fail an unsecure manner (there is also the  
fact that you can have "f*.example.com", which should not allow #2 to be  
generated, causing more complexity). However, adding a separate rule for  
"example.com" in the SAN field is very simple.

-- 
Sincerely,
Yngve N. Pettersen
********************************************************************
Senior Developer		     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************