Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

Marsh Ray <> Thu, 02 June 2011 16:07 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F1408E07F9; Thu, 2 Jun 2011 09:07:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Xmx-gJq8w1Xz; Thu, 2 Jun 2011 09:07:11 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 57CABE07CC; Thu, 2 Jun 2011 09:07:11 -0700 (PDT)
Received: from ([]) by with esmtpa (Exim 4.72) (envelope-from <>) id 1QSAQP-0004oW-76; Thu, 02 Jun 2011 16:07:09 +0000
Received: from [] (localhost []) by (Postfix) with ESMTP id AB72E606D; Thu, 2 Jun 2011 16:07:06 +0000 (UTC)
X-Mail-Handler: MailHop Outbound by DynDNS
X-Report-Abuse-To: (see for abuse reporting information)
X-MHO-User: U2FsdGVkX18ZaeEObNEyW+qN1tQpVBHZRJYsUTihz8k=
Message-ID: <>
Date: Thu, 02 Jun 2011 11:07:05 -0500
From: Marsh Ray <>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv: Gecko/20110424 Thunderbird/3.1.10
MIME-Version: 1.0
To: Phillip Hallam-Baker <>
References: <> <> <> <p06240814ca0c32f70867@> <> <p0624081bca0c624c205a@> <> <> <> <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: "" <>, Paul Hoffman <>, TLS Mailing List <>
Subject: Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 02 Jun 2011 16:07:12 -0000

On 06/02/2011 08:45 AM, Phillip Hallam-Baker wrote:
> At the end of the day buffer over-run exploits will still trump any
> deficiencies in the CA infrastructure. But those don't have people
> running round suggesting urgent remedies because they are too common to
> bear notice. CAs and RAs are definitely not the weakest link in the
> chain here. Anyone claiming that is either grandstanding or has failed
> to pay attention.

Well that depends entirely on the chain in question doesn't it?

Not everything that uses TLS or certificates is an unpatched web browser 
with Adobe plugins operated by an ignorant user for the purpose of 
securing nothing particularly important.

Over time it becomes increasingly difficult for _any_ distributed 
application to run over ports other than TCP 443 due to the growth of 
egress filtering. So stuff is bundled in with web traffic that may, in 
fact, be implemented for high security requirements.

Perhaps a solution is to implement your own application-specific trust 
root that doesn't rely on the current profusion of CAs. But as an 
application developer I can attest to the fact that it's difficult to 
use standard platform TLS libraries without also trusting everything in 
the system root store, too. Some sites will insist on using their own 
in-house CAs too, which is fine, but it's further pressure on everything 
else to integrate/be vulnerable with the browser trust model.

The net security world has changed dramatically over the last couple of 
years. We have to move past this 
broken-browser-as-least-common-denominator mentality.

- Marsh