IETF Logo Mail Archive

Re: [TLS] Proposed text for dnsssec chain extension draft

Richard Barnes <rlb@ipv.sx> Thu, 26 April 2018 15:41 UTC

Return-Path: <rlb@ipv.sx>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72F7512711A for <tls@ietfa.amsl.com>; Thu, 26 Apr 2018 08:41:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.908
X-Spam-Level:
X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YCOtqeeuz6uQ for <tls@ietfa.amsl.com>; Thu, 26 Apr 2018 08:41:07 -0700 (PDT)
Received: from mail-ot0-x236.google.com (mail-ot0-x236.google.com [IPv6:2607:f8b0:4003:c0f::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B37B126D45 for <tls@ietf.org>; Thu, 26 Apr 2018 08:41:07 -0700 (PDT)
Received: by mail-ot0-x236.google.com with SMTP id l22-v6so19377770otj.0 for <tls@ietf.org>; Thu, 26 Apr 2018 08:41:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=yAPx+EadgMw8VTM3ThlHPNgdzPt4yw7bW82r/PdN08Y=; b=nPqH8TPp54GZZqPDlawwpNkcG8lfvh8B8PL0Wn6DEgW65CmQ6u45GLE5gqG6LWRSBR 3fOMknHQczZaLe0gfjn4vv+5+OIclb8Bq5etTny7b0qx+cfyAJ6QL/KZY/1dnvtCYbxz h4SFywF6CmlwRVHOtQqWNhVe9jaSUwOwXtKz5pH3vty2ZK6iyL1HLVtkJk1a9cZSBiNt wKZ5rC4+RvK2SYBxFPDtrCPEbGOsJtxzMBaWVkVGsYSXtYIj7+YKM942VkBP+7g1eQ9L HoNwRwFNxmq807OOIpRUjWa64pRRwfapNjT3/bDRTIPQzWcHnbKCGdnC7PKRHSEEeAyU QZEA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=yAPx+EadgMw8VTM3ThlHPNgdzPt4yw7bW82r/PdN08Y=; b=NPeVl2A925J+Jmm6ZnEwhI55n9W1ha6ZQvyGU0qwVipawS3fd3wqm+7UmF0qCyxtnL AVInX4PGWVg9d1Hwy1QlX7zC9HHnHRxkEQ3BB0iTYYMO31spbVUPT5Y097b98zIJMBSQ iDiUGv5AIDZOZMe2BIe7hu6NEYvEwOtH9MqYodY9nqOw4DITJAQLayC9OJCbwJ2zEc0D oxbMdOH0Yjic3dw8Z2y5nRuVIn1klumkxnk/yrloBtX5D1Ht/JgYzqsNGdZceajaPYqi lIomYMW+d4fimEjQT+NoVaFa54WsH7t+qy6rnROKK08lebz7ZJs4rEe3QIjKJ6nlDmFX tlvQ==
X-Gm-Message-State: ALQs6tDB1JrNHWEjPI1xs6OINu8DTlxYA76Qu5RgUzz8OhsHnf2xvZgO i5TwlAKF4J+AFTzEPEi18PpO4L9oE/nFYptemElnQDEY
X-Google-Smtp-Source: AIpwx48avgLdqtUP0JVvj5LKgxNIz4HxborTr58PEytFqAoVmaf/q/zcxMC6uVhmBCht8FCyzGiO7/3GtIbnBHt/+kA=
X-Received: by 2002:a9d:310b:: with SMTP id e11-v6mr18485373otc.84.1524757266344; Thu, 26 Apr 2018 08:41:06 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.201.121.149 with HTTP; Thu, 26 Apr 2018 08:41:05 -0700 (PDT)
In-Reply-To: <20180426152206.GM25259@localhost>
References: <1D2EB7F1-B796-4459-93C2-443A7104F33A@dukhovni.org> <CABcZeBPNwBKqVLmNR=KqrxhwbxJZPs_-oK26XbK8oq1yRaS8eg@mail.gmail.com> <1EA85624-3A19-4EA3-9A2E-D1DE19414F8C@dukhovni.org> <CABcZeBOauDUGqTz6TCHemonWKEx91NtQmTw8cOfyU1D51+RODQ@mail.gmail.com> <20180426152206.GM25259@localhost>
From: Richard Barnes <rlb@ipv.sx>
Date: Thu, 26 Apr 2018 11:41:05 -0400
Message-ID: <CAL02cgREhrRUgPO97zuMhdWpSOisXDenMXmxebEL28VactYY8g@mail.gmail.com>
To: Nico Williams <nico@cryptonector.com>
Cc: Eric Rescorla <ekr@rtfm.com>, TLS WG <tls@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000003ac124056ac2376f"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/OtuQgHOxWrR9S9029AFc_91-XHk>
Subject: Re: [TLS] Proposed text for dnsssec chain extension draft
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Apr 2018 15:41:09 -0000

On Thu, Apr 26, 2018 at 11:22 AM, Nico Williams <nico@cryptonector.com>
wrote:

> On Thu, Apr 26, 2018 at 07:50:08AM -0700, Eric Rescorla wrote:
> > On Thu, Apr 26, 2018 at 6:51 AM, Viktor Dukhovni <ietf-dane@dukhovni.org
> >
> > wrote:
> > > On Apr 26, 2018, Eric Rescorla <ekr@rtfm.com> wrote:
> > >
> > >   * a lifetime field
> > >   * enforce vs. test
> > >   * a report URI
>
> We will need only the TTL.  We will not need anything else.  This is NOT
> like HPKP.  This will pin only the use of the extension, and NOT EVEN
> the use of DANE since you can send a denial of existence and you can
> *always*[*] do that if you stop wanting DANE.
>

Until my DNSSEC signing infra breaks, the signatures expire, and now my
server is bricked.

--Richard



>
> [*] unless you're operating in an alternate DNS universe where no zone
>     is signed, not even the root zone, but then you wouldn't have used
>     this extension ever, and you'd not have pinned it).
>
> Because we'd pin only to the use of this extension, the TTL is
> sufficient.
>
> > > This specification is always "enforce" (though my pull request
> > > changes a MUST use DANE to a SHOULD with some necessary added
> > > conditions) and since the report URI is in good measure to
> > > support non-enforce mode, we're back to just max-age.
>
> > But this reinforces my point. I think we ought to have an enforce vs
> > test flag and a report URI (and I I don't find your arguments above
> > about why we shouldn't do this persuasive.)  Standardizing this
> > functionality would require resolving these issues.
>
> Strawman.  These are make-believe issues.  Is it just to give the
> appearance that we couldn't possibly reach consensus on just two bytes?
>
> Nico
> --
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

v2.23.0 | Report a Bug | By Email