Re: [TLS] [pkix] Cert Enumeration and Key Assurance With DNSSEC

[Matt McCutchen <[e-mail]>]

On Fri, 2010-10-01 at 11:29 -0400, Phillip Hallam-Baker wrote:
> In particular I am very concerned about the particular approach being
> taken to security policy. What the proposers are attempting to do is
> to create a mechanism that allows a site that only uses one particular
> high assurance CA to 'protect' themselves against SSL certificates
> being issued by low assurance CAs.
> 
> As such, this is an objective I approve of and is one that I would
> like to see supported in a generalized security policy. It should be
> possible for a site to make security policy statements of the form
> 'all valid PKIX certs for example.com have cert X in the validation
> path'.
> 
> What I object to is the approach being taken which is to use DNSSEC to
> replace PKIX certificate validation entirely.

Realize that I, and I would guess many other site admins, want precisely
that.  PKIX is complicated, whereas once I have a DNSSEC signed zone,
placing my TLS server's certificate in the zone and knowing that clients
will accept that certificate and no other could hardly be simpler.  And
why shouldn't I be allowed to do it?  I have complete authority over my
zone (even for the most part in the present public CA system).  Nobody
gave PKIX a monopoly on the determination of certificate acceptability.

We could support a more general scheme in which positive assurance is
separate from restrictions, but don't be surprised when a significant
fraction of sites use it to effectively "replace PKIX certificate
validation".

> Worse still, the proponents refuse to allow any method of shutting
> this system off. So if I have a site where I want to use DNSSEC
> validated certificates on the mail server, deployment is going to
> impact my Web server.

Yes, there should be a way to make the exclusivity optional, but there
may be better ways to solve the problem you cited, such as placing the
DNSSEC certificate at the SRVName for the mail server.

-- 
Matt