IETF Logo Mail Archive

[TLS] Re: Last Call: <draft-ietf-dance-client-auth-09.txt> (TLS Client Authentication via DANE TLSA records) to Proposed Standard

Eric Rescorla <ekr@rtfm.com> Mon, 26 January 2026 20:08 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 1B9FFAD5D40D for <tls@mail2.ietf.org>; Mon, 26 Jan 2026 12:08:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20230601.gappssmtp.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 04JP_ZF6a9SD for <tls@mail2.ietf.org>; Mon, 26 Jan 2026 12:08:22 -0800 (PST)
Received: from mail-yx1-xb134.google.com (mail-yx1-xb134.google.com [IPv6:2607:f8b0:4864:20::b134]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 52137AD5D3A8 for <tls@ietf.org>; Mon, 26 Jan 2026 12:08:22 -0800 (PST)
Received: by mail-yx1-xb134.google.com with SMTP id 956f58d0204a3-6481bd173c0so4169169d50.2 for <tls@ietf.org>; Mon, 26 Jan 2026 12:08:22 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1769458096; cv=none; d=google.com; s=arc-20240605; b=IowJlnJRpqaiiuc5J/UZZ+C8CK6i31JCZN+KAGye48ckd7Q5CVZuilW+JJU2Rh15kg IjGf3PJDEiVFB/A+EFalSuaSt/KH+px/MK/c5TeLbUUOrgS/hQJ1hHjksG5XuADHlw/J lGSOR0L+Q+xfgl0wLZGRegAECSEyXGXpzAn+g0uyJZwB2wHAr5yYggyr7dRp970ioG2L kuKwMLsZ97VAmUcMo7D2QyGnk3ChMfSnbs5MlC6BEBqPGLuVvlIBhr5WBv3FmRb/vSg+ L/O1AINz1qn6ObvZxvjWTBEyUIYCOZPdzIyb8QoPWDaMtNnrYPF3d9Bof8jsB2bPd3+U 6yFw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=TTythsWG/S8AFMAqu5bPGeObKYHVin2wU/26WyFLrqw=; fh=1K4xUR2u4cikF/oEN01P4vcNMcpHM7l4MQARmJo3/A4=; b=EOVbd966ugzV5GSy06bB0IjOR6LSoltFqaa+TkKYvCKUfuh5cBTuPYzRVtBK0RZTcE aypDzmwM4c7lYYAaNyih5I+0KcOUtfHtpbKLt5uGcWdfI5ImLetFULm0n1FAV5Lu4+sD XcOglBJaZrkRulM5/S1WiPiwCRghBM0eCxzr60Yckf6lUxoXDmcdXhEB6QD+Ktx2aqVk A8AV7pARM3Wd1x8cPSL9/BwuYAWVt22/Xvh2j1x/ozZAj3UBmjKF9MqvEFEI8mHfpBl0 zNIK0Gx6zx6ar1SwPDR9mfhKuVqY0yRlVoHTS12lcwvNydz1bx/aX3GMu29pi0byJ/BF GtAw==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20230601.gappssmtp.com; s=20230601; t=1769458096; x=1770062896; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=TTythsWG/S8AFMAqu5bPGeObKYHVin2wU/26WyFLrqw=; b=xJeJsG2ksGmVAR/96JLzs/R7IxlV0GyK4DbYRySYq6LV7CyQKMsG3xgbe/E8t8wK2r lH02jHxpoZ6kdpv+Q+7VpvMEXdI5tabi8vDq21NQwjTRSR2VLZqc7+SO8TSOO47s6Nte JW/MHg0UsjymyUJwqpUcy22yXfcz6iUdsi1l0NX4LQgN8zMHzJ1A1qwwx1Wif5L0TNSW L+IwSmtGM7SyDIoLWzyMio9kZCCDrzKoAi7fSxWyhWWcRY4I0zR/YDtWhoVIOMER6NNL psasP9Ou8WM1r6GqeiL8d4+kU49YSJrRJfRYXNryD3RKdY7Zsm7tn6jPrs4kpa5+hN+/ Cpog==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769458096; x=1770062896; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=TTythsWG/S8AFMAqu5bPGeObKYHVin2wU/26WyFLrqw=; b=OUJXiEjMafIiV6VwHM+WHczTbeK4uB/LUu9uoiQ+OqzyS1P2Dz7f04fiCK6+rxf1WK YfTZsbL0Q+v1sUFDmK672oHtqJFsy9Y+bzkoHxBeKKwwstqFSx2JR+YWMo1a4kfI6J6Q ywGU2WRbKQuMIGIWSHYLWXATkkUxeOVVFazniqJ7Vofxk7lWFKzKmD3/MuwrdnnRHYwH ZCP5org64UI5vSDAdJcJYZ4Ezf53ZR47t8rWMpNLv3FwFsF5VHpV3FiaJP8q5L8Dgkbw 3BX/tqinLRWLfQmj+wMVJ0rq4Y2cvJGqEl9hEm+hOTkJNamq36b9vE4eNhNht0OWbNwV H1SQ==
X-Forwarded-Encrypted: i=1; AJvYcCW95CU0ici2UGqKfFOZc/aznnxvwIo8lP09MUc5xsf0rNvnoWNceNhifc+m+4WCRzV6aZA=@ietf.org
X-Gm-Message-State: AOJu0YzTR/XkfH5Z75mBw5AgZ9MoPsJE+qXvQ176WmKeC0tLeeMnFHyo +6SVcHAuBCghkSi6+0mYLZmlxlwmBCHId3dEm6W5j4E+e/8LdgRcnwmX43exZojct2JPSXlVY3d JAjfzEilcL5wxW6ziBUQLEWqLxv7BFFYRZn9M+lxRiQ==
X-Gm-Gg: AZuq6aLHZbMcTXgqk7gpAiLM0xXCOj0y+SJlgERi+dJieDclvIJxYvdmga6HilDdnpl EzXIBBeJPev2T1c1OKd3v71IGAbmnfbTRweTZ8NLKyGiofpZnM7PADupXTfJUyBfHAH2VjK51eG e7B9dvML4UZnCZbKjk7KbiHE5V9B9jlgrFrakOlXbTVSP9xV8WvaE64vRA0snESGYd8DFUvHRnV i+JkKAajwwjvVDib2LlgcVIeI1fUH4jOqNLJHREGNWaMlTKlkWq81966RAM/CCo3Xb8gkYHGt8f PI7J8j//OilCvW62tIm/IxHuUS3RgIfH4JL2xHhDR7dsGG5o3k9+uoWiSsXajn8rzQYQZz+PCxh MWPN+Yn7KTw==
X-Received: by 2002:a05:690e:188f:b0:649:6b11:78ea with SMTP id 956f58d0204a3-64970b5005bmr4333731d50.14.1769458096127; Mon, 26 Jan 2026 12:08:16 -0800 (PST)
MIME-Version: 1.0
References: <176529902699.1146491.1360588667931244217@dt-datatracker-5bd94c585b-wk4l4> <CABcZeBOCNZf-mYJ2DM1YTnUAYpvtyc5Ba2qQ6aOmsYhS1y5fvA@mail.gmail.com> <CAHPuVdV4TvP4kHsEC=7K5QNFZUktYCRU44LqJr33fzB5Md+Q1Q@mail.gmail.com> <MN2PR17MB4031E3807DE7137A169C2E24CD93A@MN2PR17MB4031.namprd17.prod.outlook.com> <CAHPuVdWssWuFsZNjKHOXc=sRyEDwAzpbtaUkZuTMvZW0=BXGJA@mail.gmail.com> <CABcZeBMcShiaC-Rrd8zdH=xa4OU2dtKtAVVfZF496t=2qJS-fw@mail.gmail.com> <CAGL5yWY3xqxaxgkNg6sYH_GSSha9tVCbcam59OiEnm=7JAyTMw@mail.gmail.com> <CABcZeBPjGrhE_QD2z7=aEMhE=yZbM_uh1aLpV8g2cg_TxbEoBg@mail.gmail.com> <CAGL5yWZ1uCtkQfSpa4O=fiy70XaVdNgQPCPx1Dr4hatC8cc1hw@mail.gmail.com> <CABcZeBO3NOWrSauv06f1vFU7wa_iLNEZXWnF_6F0aVzf_8rrng@mail.gmail.com> <ec558fe6-1002-4ae1-8dec-b40c01da90e4@tu-dresden.de>
In-Reply-To: <ec558fe6-1002-4ae1-8dec-b40c01da90e4@tu-dresden.de>
From: Eric Rescorla <ekr@rtfm.com>
Date: Mon, 26 Jan 2026 12:07:40 -0800
X-Gm-Features: AZwV_QgKTdagqUsPjbTno_srtVhP_7_iUC7lA2GlD_E6Ys1T6blOzru7fjl9NM8
Message-ID: <CABcZeBOzJjTUwDWYK0xq3Wm+VFDH5TZddbqwVHh=qCgm+jR3Bg@mail.gmail.com>
To: Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de>
Content-Type: multipart/alternative; boundary="00000000000043d2e906495011b4"
Message-ID-Hash: RDZOE6ZDRRHNZGXZBVSTXD7GHUBQRA33
X-Message-ID-Hash: RDZOE6ZDRRHNZGXZBVSTXD7GHUBQRA33
X-MailFrom: ekr@rtfm.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "last-call@ietf.org" <last-call@ietf.org>, "dance-chairs@ietf.org" <dance-chairs@ietf.org>, "dance@ietf.org" <dance@ietf.org>, "draft-ietf-dance-client-auth@ietf.org" <draft-ietf-dance-client-auth@ietf.org>, "mcr+ietf@sandelman.ca" <mcr+ietf@sandelman.ca>, TLS WG <tls@ietf.org>, Paul Wouters <paul.wouters@aiven.io>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Last Call: <draft-ietf-dance-client-auth-09.txt> (TLS Client Authentication via DANE TLSA records) to Proposed Standard
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/VOdkRDIRcY3DDkIK3J6MFqTEDKI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

On Mon, Jan 26, 2026 at 11:55 AM Muhammad Usama Sardar <
muhammad_usama.sardar@tu-dresden.de> wrote:

> Maybe I am missing some discussions that happened outside of TLS. So
> apologies if this is the case.
> On 26.01.26 19:36, Eric Rescorla wrote:
>
> Regardless, the argument cannot be "use the webpki because it offers
>> better privacy features" because for
>> players in this space, non-webpki authentication and authorization is
>> more important than a privacy feature
>> that defends only against passive attacks.
>>
>
> I think you are perhaps misunderstanding my comment, because I'm
> not talking about the WebPKI at all in this discussion. I'm instead saying
> that the client should send the DNSSEC chain in a TLS extension
> rather than having the server query for it, thus avoiding revealing
> its identity on the wire. This is entirely isomorphic to the current
> identity structure.
>
> Do I understand correctly that you are proposing the DNSSEC chain to be
> put as an extension of client's Certificate message of TLS 1.3?
>
Yes.

-Ekr

v2.37.1 | Report a Bug | By Email | System Status