IETF Logo Mail Archive

[TLS] DANE & TLS 1.3 (was Re: Deprecate SHA1 for signatures in TLS 1.3)

Dave Garrett <davemgarrett@gmail.com> Tue, 14 July 2015 04:38 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94DD81A005A for <tls@ietfa.amsl.com>; Mon, 13 Jul 2015 21:38:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L-ug21gGFaqw for <tls@ietfa.amsl.com>; Mon, 13 Jul 2015 21:38:54 -0700 (PDT)
Received: from mail-qg0-x232.google.com (mail-qg0-x232.google.com [IPv6:2607:f8b0:400d:c04::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F71E1A0045 for <tls@ietf.org>; Mon, 13 Jul 2015 21:38:54 -0700 (PDT)
Received: by qgep37 with SMTP id p37so74616265qge.1 for <tls@ietf.org>; Mon, 13 Jul 2015 21:38:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=LQbaJ9eHlHq+Ah7s+wT7cDeB+xYJdRh9AESGLXfnd24=; b=zT+VykMTDKbZANxaBqhKh3otZ73EtG84nmNUghlj1Jw92FS2JQoaWwr0B2T2ad4RZR Y1i5+29pQ24Y6PiNEeQjiHpukpWa7NAatZSLvFQ159RjCDdXB2BsCxsA25z9Kk8p3Www Utc4omHERVoLoJfIfBZCXtUEtZwWU1F8/btqmUBABIfqwxlZ6kQeBl3hus+kp0k4x/Qt 9gWx0vpQgDZSxdTuClHDy5c2VG5qhxekiD3ll3L17GJYGfyiB35BACzGrhawtDS0bgwl u7NPploSGV6WG9YntPS91GRmhhK3MXsZqaT51+2fafhfYAxtpFT+ZyCQvMFt/V8pE+wE R6Yg==
X-Received: by 10.141.23.143 with SMTP id z137mr21737652qhd.46.1436848733502; Mon, 13 Jul 2015 21:38:53 -0700 (PDT)
Received: from dave-laptop.localnet (pool-96-245-254-195.phlapa.fios.verizon.net. [96.245.254.195]) by smtp.gmail.com with ESMTPSA id 18sm12182899qgh.40.2015.07.13.21.38.52 (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 13 Jul 2015 21:38:52 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: Viktor Dukhovni <ietf-dane@dukhovni.org>
Date: Tue, 14 Jul 2015 00:38:51 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <201507111709.27725.davemgarrett@gmail.com> <BLUPR03MB1396A5E9F837D1806D5DDBA68C9C0@BLUPR03MB1396.namprd03.prod.outlook.com> <20150714024710.GR28047@mournblade.imrryr.org>
In-Reply-To: <20150714024710.GR28047@mournblade.imrryr.org>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201507140038.51345.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/dETV5COu4jajhb-bJ93vzB6RALY>
Cc: tls@ietf.org
Subject: [TLS] DANE & TLS 1.3 (was Re: Deprecate SHA1 for signatures in TLS 1.3)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jul 2015 04:38:55 -0000

On Monday, July 13, 2015 10:47:11 pm Viktor Dukhovni wrote:
> Furthermore, DANE-EE(3) clients and certificate pinning clients
> cannot use anon_DH, they still a recognizable certificate from the
> server, they just often don't need a recognizable signature.  Even
> DANE-TA(2) clients might be able to stop part-way up the chain
> before the objectionable signature appears.

Generic open-ended question: Is there anything else with regard to getting DANE working more smoothly that needs addressing?

The current CA-based system generally sucks, and whilst not everyone agrees that DANE is currently the ideal alternative, fixing issues inhibiting it could improve things here. It really would be nice if TLS 1.3 was as DANE-friendly as possible so we can start getting support built into more clients and be less reliant on the current mess.


Dave

v2.23.0 | Report a Bug | By Email