IETF Logo Mail Archive

[TLS] Re: draft-ietf-tls-trust-anchor-ids-00

Luke T2 <Luke.T2@ncsc.gov.uk> Tue, 11 March 2025 15:10 UTC

Return-Path: <Luke.T2@ncsc.gov.uk>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id BF00CA021B6 for <tls@mail2.ietf.org>; Tue, 11 Mar 2025 08:10:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -3.036
X-Spam-Level:
X-Spam-Status: No, score=-3.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.938, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ncsc.gov.uk
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id afIvQKc1L4lW for <tls@mail2.ietf.org>; Tue, 11 Mar 2025 08:10:33 -0700 (PDT)
Received: from LO3P265CU004.outbound.protection.outlook.com (mail-uksouthazon11010001.outbound.protection.outlook.com [52.101.196.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 0B051A021AF for <tls@ietf.org>; Tue, 11 Mar 2025 08:10:32 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yhhFTpKhAQb3Yysxn965sPrsiz16iywVp6WHeLS0YpFSJQ8EulTp/9ZOC7IAH+DIiJIQdH/lxj9O4v5BfQ7axLaRH5/jnymh1hoN8BfaSEfGCVfZnLoDerbZGKbq9NBEKMerv9rc2vr/1jIIkUtXgFF//3kZeQAS2A8B2C8PPb4HaCRZVLbXUVeTsS1rqAk9iXENpghbfWMiaJKmmen+vgKbgyOiHoKu8nbs6i6E9rzO2Khv0FSrA1C6LafryX8dIlqPACeCpwbbaZnhpz41d1x/vhjnkSgAgcrAxqnNmFoLIAAVRUNnwEC0tuPc3iXZbj+8pcT9VBy3I/B+1eaETw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=z1mCjHkF92nOXfO1wS4PclDvpTPzbliH0tv0ZyWrNLI=; b=OdFg05Jwc83LwBDpeptnxZ6MmMZA1e55umYYlKI/ftCMpun6RF0gZuoUMEHHoqFwehoQBwIeII4d+NryiFi7/Xe36z9N8wT+7nYtfT9aHAab7X9as+tskHnY1YB0BItb5IUAfrVpL+hjU5ZMzJq6n4SLJekknLf/GifSr5k3UKkByn9QMqqPCRc4DJMAY3KzR7T7SVFQKhVaiUQQnekPFqhJb8qVqcYtbRv9oEaI//ZSWmdtL3lwC1JcsckV1NLnRxgqXA6guCjfs/FOBkH7Jsd20kGQdggD76NsongRNUGDSanbwd+rg4pWQ3HJ8fn+fRgwSmYIVxwKu13jr/EJtw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ncsc.gov.uk; dmarc=pass action=none header.from=ncsc.gov.uk; dkim=pass header.d=ncsc.gov.uk; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=z1mCjHkF92nOXfO1wS4PclDvpTPzbliH0tv0ZyWrNLI=; b=I5RqZZH5z89iZc6Mr3mzPQ08G6VdS9LfdKWO1PKIZlz5xTlZXAdx2W2qc0HujbJfDpOqaFAav6gbztZAqabMH1MwPuizaVRpirYdEHxnieExzdyVWfvnOluyP39NPFSDoau848sJByb+ANjg6WO/LW2CEoKwdfkGr6VQLwvxhFj35zlsQdQvz0EIMCKeDJnBfPMJux1b8mq7UbH5PKQC21jwWo3Fo9rQSAjSpd7m58+dJs9rhAsZMZQMam9GdmdqU8FOwoL4f4vHSMo7Xa/FgN0boR5ohc4nRR55eSWi4O/0JnRxaXPNaIfWElZtqxfy5Q1i07uVXbuP1D9VsW5M8Q==
Received: from CWLP123MB3460.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:6c::14) by LO0P123MB8072.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:406::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8511.27; Tue, 11 Mar 2025 15:10:30 +0000
Received: from CWLP123MB3460.GBRP123.PROD.OUTLOOK.COM ([fe80::22e:f1ed:c27d:2791]) by CWLP123MB3460.GBRP123.PROD.OUTLOOK.COM ([fe80::22e:f1ed:c27d:2791%4]) with mapi id 15.20.8511.026; Tue, 11 Mar 2025 15:10:30 +0000
From: Luke T2 <Luke.T2@ncsc.gov.uk>
To: "tls@ietf.org" <tls@ietf.org>, "davidben@chromium.org" <davidben@chromium.org>
Thread-Topic: [TLS] draft-ietf-tls-trust-anchor-ids-00
Thread-Index: AQHbkpdrSaTVhRowOUm07PiBW8m02Q==
Date: Tue, 11 Mar 2025 15:10:30 +0000
Message-ID: <CWLP123MB34607D198FC67A1E1C995C43F8D12@CWLP123MB3460.GBRP123.PROD.OUTLOOK.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=ncsc.gov.uk;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CWLP123MB3460:EE_|LO0P123MB8072:EE_
x-ms-office365-filtering-correlation-id: b9ad971e-6577-4ce1-1467-08dd60aedd23
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|8096899003|38070700018;
x-microsoft-antispam-message-info: eMByZmf9RiNywbAKpKdsEGA/2FC6ne7OqhGgYlTDgB2E3kxb1HdocV6QoPVHWHftJUzp1/nG7og/UUticZuYg7JijJGB7aKM2CvUPkIa46l2qHL4uNO+zbQ4le1xuQTg//gurBrU2Gd7R1ll4CiOETJLAc03GUEFxS6eVawz1Zt0WiYa0I+HLt06OPW2b//IAbCNbKMsdaWtkFiXPeaJ+ZvsjsbjxZ8LX1uvDHo7B8IDftJZ3xcOLA1swop8cFPj73Z7l4hiRyZrx6QcTnq6RDVb9NW87CwD7/J6O8Tzr4dspm/zjbinpA+5C20u0AYWiUlPMslMrGELQHXMUPBDajNt1ZQb5IpANoVJ4uNQGvgK8eAmO/lsghJOcEh4gvug4nbErVeF0VpPskNjx375i8OcYE/vTx+JN5p+afP+MVTA5u/AQVfmTZd6vpCcdRAglRpK/NM/0tKElFpZ+PVmHgiv7ljVAaNjXYtPzTQumDncGS5dptkwM1QMELIwvO+tlqcTPpVvVXnYW05qLxxUdbCzzb1BiLXwHBcnVSCrPY3+K309NOp7xgRR+VTe/yNCJImH9ccwlV0QaBmmXV5kpW4ZRRQWdNLGqeZr/pQ4z3hrYB6x6SWWQJWiw1HIe/glFXL18+/xLb/witeax0N8M3PpUD8BGqPY5QuodKxOMnlbLvoQDp0XO0P/C3VHDcprKwbZxn7K7oKtJDimPEWcrbtcyy6dnB/XOeCdL7Z2s/wDTbj83vfRfSOP8r0E77xF3AJ0pzKEN1jszvMm03YMp2RsHecD78uttHly5hmKCDsW3Kq4HXaFApgeFWwMWbF3gjzlIwUuAGzVZNcWFlX9wonfQzxFxn5xCYMiH1vucCBEJSqZCk1NV12MCGkE7b+rGDUrw1kYFKQvv/V5468QdLqwC8ijzq3hQMJjuEzU9KFcg6PD2GY8utltSTl3MBMIYBJYT34uUNQKPgeU2EiL9TeSqstiaiMhPHIl2j0ZATcfoG6IgmIFyrP6Tq1Ygs/pgjC0kAj+R0osThyF2Nq5aGU5c2YZWMeEOxp00ZDdgkxChKujtv8aDbLrSmIStbdjfs8B4bT35NZKdc7E/j/NsOMcnC0jheJrrSLQMZET5jaiX6lx4mT/XYkNISBsuwyr4Xo/REpmO0+t2AP25Cu2T605VSbpKh3fG2RfjWs6hX33TcCkAFegASRsB2qiEBN4LHB0g8T9XraJ0C8y+SA9BSrJOJJoTGnfLWKRvshC8B49DV8UaW8F84BPhueTVU0vPB8IHwYSHXED1RwA8YDlrdA4piDNDLMlUfjh4X3U2zMN5XV7/RKd0+i+hx4VCk/vQdH//OB8ttltKoDeiADDzIWqmaGFc9fLEIirNfd7SXT4+6f6ypR0PM8BzW2CtEjAw3bMFiNnP0UhUnbKpInnMuASrvvWdAkNG8UaeWG8Yy8=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB3460.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(8096899003)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: VvMpmOsHNQZgMGSewvf5UUqXLjUY1iM1YUTp65mEgKA7FbI97HhEBhE/OKsTYCea59pVVUH5KgrKHYduEMi3gzBjsSUFaf8CpgWvKLE9tJiwIzD+eDn+yDdvRxtfklonSGU3guZixJbZvzS7Q66U0TwYyuTpIxOB8HoCrJWQ3Iz5TB7VZQOIzho335MrR9E4v3/GD3n7ra8GaqajBHnzF4T2KeuhOofW4/dwMYzfY+AWxJjgB6+/bI1voPuvQzYxqyfW2/l5E1IV3ugIJGAM5GTq+ClP4AIstQlK3kOf07V4/EwZNGeURZaCO7PsoP+u9EXwv2Lj5jVZ7kxtF+2vpkcAHFRFIEJ/Gfep7DnNBIS1eb1B08aJ8s7XF66a3wVqU2R5G3dlIp/qJEWvnAKr4/cScbzTpwnED1U6ywoYICK6xSseKHKoCJz8LcfTp6udGquVimIjpzT1GXr7Kw+HIhmCyU9fq8SZxJJ64/jXstzWo1oawHX7u0LdizTVhtD/w2JbfyjE79eYyWnX1wmuiIjG376qHgKI65JMYOJ7tt2GEfgSWKV2/OPLxkd0p4r8EiwXVRDNvO0jid+yXMAu30TYsc0dFzqsYVBMYxOfZgQbPPwxmU72/pOHk6f4o3Ph6wM3ZsCw9lAFwal0Hw1FgvSPHEFqlcyEsIaWoCtthIl3tqZOGcn274HB02oq++58pJKAROfGMshuc3jMiLk5ICm7fKrEY8rnwa59cisJ7dGY5Hv0QmOcYcTbPdR9HwslKgSboOL9tEnd8idmMepuivAJoPvQZaAScJiGQGKV8PxTejuF9zJlcUFAgOP5v2awlx18Xiy4yQTAf1r6W3AsyeT3wNZXsIXoHHAPlNABxo6JC8kgc8S1zcx6SKa4s2lsD3cSRV4REBoEGnHg5i8eWo6HN2uxSN7p1wn4JlcVmw2SKQdNAU8gCnDWqNY5Cgf5gzr20Fzk8AFabk/62essQuV116dZ+FsOeJC61WmVlXq7xTYDFQ0fCQwQUJ5QodBz0wlxhIPpO4QkM1l++p3+cBKMLs+UrZYedCnEE7kKauV3AfL83zz0fJ57t9TisRc4AXE7UxyA6s0HWWLbECaCEj5WdhONnkcyYNIzhyd3Mkl5nWCR/ulLPoSHeWnO7odXiNbmDkNDd4dw7TjR9GA3QgN1dXvMh3+1AjoC2rtb7K5sLHQF35+RnDgYTCfagWEa3j6SaKz5N4QxzINVbw5jEuPyq+sHYmWE4PCm9kM7j4zYCiKcI6pHVljNiYOkQC7iG/oK5qpuC4BKdgmFJU0S1NFpJLteeGxVuCtVvvsDasaWCZdGk00pjaHi8+S6VSU7K++aAzRLfgSo94dOc1wREI4MHx4SGTNUFcQZtDPpZKDZtUGJidhWpBq+mhYob20tjzgm3VnA36TT8ULQc1L2Fm7f3kynTujHjW7OaWnQy/fxEJKXL4IxI2Z1FwLyOENqggsZyjUKkEwJBtGdCmSUNxl2SSWV1K1kfJBQO2nRXUQE08lNTs3Bp7sRlTkJniYdXYhQuYFDCoUKnwU7g3ydhXzXgo/kuJsuvYJusGzwJ5Q=
Content-Type: multipart/alternative; boundary="_000_CWLP123MB34607D198FC67A1E1C995C43F8D12CWLP123MB3460GBRP_"
MIME-Version: 1.0
X-OriginatorOrg: ncsc.gov.uk
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB3460.GBRP123.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: b9ad971e-6577-4ce1-1467-08dd60aedd23
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2025 15:10:30.6609 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: CMk7M22WaWTRzTMxfWsucMgQiAtQEpZYd+/jrcZ0UNxqTxaoXvAjuXkyoXyLlWvzA3plGGpWyU9BlhAMwqXMKg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB8072
Message-ID-Hash: F4MV5GA2AT3S6Q22NNU742UINEIVBMA2
X-Message-ID-Hash: F4MV5GA2AT3S6Q22NNU742UINEIVBMA2
X-MailFrom: Luke.T2@ncsc.gov.uk
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: draft-ietf-tls-trust-anchor-ids-00
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/_KRqUkXizTjMLE0wMAR1tkxQORQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hey David,
 
Thanks for the draft! I had some thoughts about how Relying Parties build their list of Trust Anchor IDs to send to the Authenticating Parties. In the draft currently there is different behaviour by the Relying Party depending on whether it is a retry connection or not.
When a relying party receives the tls-trust-anchors in the DNS Service Parameter they compute the intersection of the received trust anchors with their configured trust anchors, then they use that information to determine their trust_anchors list - in this case relying parties should offer multiple options.  In the other case, when retrying a connection, relying parties should choose a single Trust Anchor ID from the EncryptedExtensions to send.
Could you talk me through your reasoning for the different mechanisms?  I would suggest using the same mechanism for calculating the trust_anchors on retry as when using the DNS Service Parameter, so the client has consistent behaviour and then the authenticating party has the final choice of the certificate chain to serve.
Otherwise, the issue described in Section 5.3 of the draft could occur on retry with the client picking a trust anchor which includes a certificate in the chain it doesn’t support the signature for.

Cheers,
Luke

v2.29.0 | Report a Bug | By Email | System Status