Re: [TLS] Certificate validation can of worms

[Nico Williams <[e-mail]>]

On Sat, Apr 05, 2014 at 04:01:02PM -0500, Nico Williams wrote:
> On Fri, Apr 04, 2014 at 10:15:39PM -0700, Watson Ladd wrote:
> > Furthermore, neither naming nor OCSP/CRLs were involved in this
> > research, although the complexity may have lead to corners being cut
> > in the rest of the code.

> [...]
> The research you linked didn't deal with naming.  That doesn't mean
> naming isn't a problem for PKI.  You asked, I answered :)

Er, no, it did deal with naming.  Search for "name constraint"; it's
mentioned quite a few times.  Several TLS libraries don't implement PKIX
name constraints at all.  Embarrassing.

I'd say that a PKI with no name constraints is just not hierarchical, it
can only be logically flat (ignoring local policy), which then results
in a lot of the problems that we've seen with the TLS server PKI.

It'd be extremely difficult to not apply DNSSEC's equivalent of name
constraints!

Nico
--