Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Yoav Nir <[e-mail]>]

On Jun 2, 2011, at 3:12 AM, Michael D'Errico wrote:

> Paul Hoffman wrote:
>> 
>> I support the PKIX WG adopting as a work item (wording taken from the CAA draft's text) "DNS Resource Records that allow a DNS domain name holder to specify the certificate signing certificate(s) authorized to issue certificates for that domain".
> 
> I haven't read the draft, but from the quote it appears that
> this could improve the weakest part of TLS (as it is used
> today in browsers) where any of the hundreds of preinstalled
> root CAs is trusted to issue a certificate to any possible
> domain name.

I'm not opposed to this draft, but I don't think it solves this problem. The issue is not even the dozens of pre-installed root CAs, but that those root CAs can have many many affiliates, whether they're sub-CAs or registration authorities. 

The two famous attacks of the last two years have not been about Verisign or Comodo. The "MD5 sub-CA" was issued by RapidSSL, which is part of the "Verisign trust network" but not Verisign itself. In the recent case it was a small Italian RA. In both cases the problem was an affiliate with not quite best practices that caused the mis-issue.

CAA works if all root CAs and affiliates follow it. That's hundreds or thousands of entities. Any one of them that fails to comply might ignore the CAA record.

PHB says that having the CAA record may aid in assigning blame, and thus perhaps at some point, liability. Remains to be seen, but at least in the short term, CAA is not a panacea.

That's why I believe that the DANE record that is aimed at relying parties is a necessary complement to this work. I know I've said the opposite on the DANE list, but I've changed my mind since then.

Yoav