Re: [TLS] TLS, PKI,

[Bruno Harbulot <[e-mail]>]

On 14/07/10 13:07, Yoav Nir wrote:
>> I've had warnings of key-changes by a server, for which I hadn't been
>> notified of the change by the provider. After asking the technical
>> customer service, it seemed that they weren't aware of the implications
>> of changing the keys (I asked them what the new fingerprint was supposed
>> to be but all I got was a confirmation that the key had changed, not the
>> actual new fingerprint). Maybe services (for which you can't know the
>> key in advance) should be encouraged to publish the fingerprints on
>> their HTTPS website (whose identity will be asserted by PKIs...)
>
> Or maybe in a DNS record. And now that DNSSEC is deployed, you can use that
> http://www.ietf.org/mail-archive/web/ietf/current/msg62449.html

I wonder if PKIX certificates in RFC 4398 [1] also need to be verified 
using a trust-anchor in the browser (for HTTPS). I suppose getting those 
records via DNSSEC should be sufficient (if one chooses to trust the 
DNSSEC records more than a PKI, or use DNSSEC as a form of PKI).

I also wonder if there this specification couldn't be improved by:
  - having a "raw" public key entry instead of requiring a certificate 
(DNSSEC would effectively do the certification), for SSH for example.
  - adding a port number/usage indicator to the certificate in the 
record (the public key or PKC could be different depending on the service).


Best wishes,

Bruno.


[1] http://tools.ietf.org/html/rfc4398