IETF Logo Mail Archive

Re: [TLS] draft-shore-tls-dnssec-chain-extension-00

Shumon Huque <shuque@gmail.com> Wed, 01 July 2015 03:33 UTC

Return-Path: <shuque@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23B3D1A1C00 for <tls@ietfa.amsl.com>; Tue, 30 Jun 2015 20:33:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t6QpxDtpA_OS for <tls@ietfa.amsl.com>; Tue, 30 Jun 2015 20:33:23 -0700 (PDT)
Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 799D81A1C06 for <tls@ietf.org>; Tue, 30 Jun 2015 20:33:23 -0700 (PDT)
Received: by qkeo142 with SMTP id o142so21150389qke.1 for <tls@ietf.org>; Tue, 30 Jun 2015 20:33:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; bh=yNLMk5QOVf8g8UPxAaQqV+S8GVYkdnc5KQqH8m47HOU=; b=Epn3hDUaQjt7MUGKRawbpqI4Du7dqFRnhsO2Io9iFNIhfU+n1WMjPf853T3M2PmWhb 372orB8/qCSeZjsw6bbVL7uQIdgPz9gr2ngiFGkbfLN3XyUbdJSaVizUZ4uDN5xKU43e eGpgJXr6oDuxB1LuvM00Nhaua4tGbYdFXh3kpn1k7pM23M/wvXSWbzpjHXn0cA8/wBP6 LZ5EQCE2nTL2KJUHzxZeh0memrU5JKAbYtnkgZ+EmwduALf59b9RyPQ4plmPFUK7vwFy RWO84VgRec+Isgy3KLCeNFSA97Q8DtLpEUhZxq5luqu+1ftNH3icRLQuN21THvmeGsyp vkGg==
MIME-Version: 1.0
X-Received: by 10.140.109.119 with SMTP id k110mr30338102qgf.53.1435721603121; Tue, 30 Jun 2015 20:33:23 -0700 (PDT)
Received: by 10.140.80.208 with HTTP; Tue, 30 Jun 2015 20:33:23 -0700 (PDT)
In-Reply-To: <alpine.LFD.2.11.1506302319510.29441@bofh.nohats.ca>
References: <55922571.8080605@nomountain.net> <alpine.LFD.2.11.1506302319510.29441@bofh.nohats.ca>
Date: Tue, 30 Jun 2015 23:33:23 -0400
Message-ID: <CAHPuVdVc01v4EKM5A9OEQ2Y78b=zZeQjKHigP3NR5nAT=y7FwQ@mail.gmail.com>
From: Shumon Huque <shuque@gmail.com>
To: Paul Wouters <paul@nohats.ca>
Content-Type: multipart/alternative; boundary="001a1139bc5026893b0519c7fc0d"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/f1IRsn1oxapJW_wmSZIVY356ajU>
Cc: tls@ietf.org
Subject: Re: [TLS] draft-shore-tls-dnssec-chain-extension-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: shuque@gmail.com
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Jul 2015 03:33:25 -0000

On Tue, Jun 30, 2015 at 11:27 PM, Paul Wouters <paul@nohats.ca> wrote:

> On Mon, 29 Jun 2015, Melinda Shore wrote:
>
>  Subject: [TLS] draft-shore-tls-dnssec-chain-extension-00
>>
>
>  We've submitted a initial draft describing a TLS extension for
>> the transport of a DNS record serialized with the DNSSEC
>> signatures needed to authenticate that record.
>>
>
> So this looks similar to the earlier "put it in an X509 attribute"
> experiment that chrome did for a while. If it makes browser people
> happier to use DNSSEC, I'm all for it.
>

Right.


>
> Although I would be happier if we just shipped a binary DNS packet
> blob (minus transport header) that could be given to a dnssec
> validation library as if it came from a remote DNS nameserver. I
> don't really see the use of a new DNS transport format, as the DNS
> packet format can already be used to add a large number of records.
>
> Additionally, code on nameservers for draft-ietf-dnsop-edns-chain-query
> could directly be used to generate the TLS extension data blob as well
> for the TLS server.
>

Yes, I suggested the possibility of  using edns-chain-query also if/when
nameservers support it. Are there any out there yet?


> Having browsers have some kind of "validate this chain of DNS records
> that is asumed to be in some validation order" seems awfully specific
> code that is "just not DNS enough" to cause problems. I'd rather see
> the data fed into existing real dns validation libraries.


Me too. But I think there are some folks who want to implement the
validation themselves in the application, so the draft is trying to cater
to both camps.

Shumon.

v2.23.0 | Report a Bug | By Email