Re: [TLS] Consensus Call on draft-ietf-tls-dnssec-chain-extension

[Nico Williams <[e-mail]>]

On Thu, Apr 12, 2018 at 04:10:27PM -0700, Eric Rescorla wrote:
> On Thu, Apr 12, 2018 at 4:06 PM, Viktor Dukhovni <[e-mail]>
> wrote:
> > Proposed text:
> >
> >    When the server has DNSSEC-signed TLSA records, the first RRset in
> >    the chain MUST contain the TLSA record set being presented.
> >    However, ...
> >
> >    When the server either has no TLSA records, or its domain is not
> >    DNSSEC-signed, it is RECOMMENDED that the server return a denial
> >    of existence of either the TLSA records, or proof of insecure
> >    delegation at some parent domain, rather than omit the extension.
> >    Clients that are willing to fall back from DANE to some alternative
> >    mechanism may require the denial of existence to make that possible.
> >
> 
> I believe that that this text would harm ineteroperability.
> 
> The difficulty here is what the server knows about the clients behavior.
> Specifically, if the server serves TLSA records and then ceases doing
> without serving authenticated denial of existence, then it is unable to
> determine if this would cause clients to fail because it doesn't know if
> the client implements the text in the final paragraph. One could argue
> that current clients could pin, but that's totally extratextual, as opposed
> t having a noninteroperable behavior in the document.

It's better to send the denial of existence than no extension -- the
client could just as well be pinning (because the I-D said it could, or
because the client does it regardless), and not having extension then
will cause failure.

Now, clients that don't do opportunistic pinning would have to... notice
the lack of TLSA RRs, but not necessarily bother validating the denial
of existence chain.  There's not even a need to say that the client
SHOULD (let alone MUST) validate the denial of existence chain.  It
suffices that the server SHOULD send it.

Nico
--