[websec] #9: explicitly note revocation check failures as errors causing connection termination?

"websec issue tracker" <trac+websec@trac.tools.ietf.org> Fri, 08 July 2011 23:04 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: websec issue tracker <trac+websec@trac.tools.ietf.org>
Precedence: bulk
Auto-Submitted: auto-generated
To: jeff.hodges@kingsmountain.com
Date: Fri, 08 Jul 2011 23:04:48 -0000
Message-ID: <070.44d3a8d3efb1d14822e889e8f61bab63@trac.tools.ietf.org>
Cc: websec@ietf.org
Subject: [websec] #9: explicitly note revocation check failures as errors causing connection termination?

#9: explicitly note revocation check failures as errors causing connection
termination?

 http://www.ietf.org/mail-archive/web/websec/current/msg00306.html


 Subject: Re: [websec] Decouple HSTS's two orthogonal effects?
 From: Adam Barth <ietf@adambarth.com>
 Date: Tue, 29 Mar 2011 14:35:58 -0700
 To: Tom Ritter <tom@ritter.vg>
 Cc: websec@ietf.org

 On Tue, Mar 29, 2011 at 2:29 PM, Tom Ritter <tom@ritter.vg> wrote:
 > On Tue, Mar 29, 2011 at 4:58 PM, Adam Barth <ietf@adambarth.com> wrote:
 >> There's no coupling between HSTS and the particular algorithm a UA
 >> uses to verify certificates.  The UA is free to use whatever
 >> verification mechanism it desires.
 >
 > This is good, but perhaps some clarification to the draft would be in
 order:
 >
 > Section 2.2 states:
 >
 >   2.  The UA terminates, without user recourse, any secure transport
 >       connection attempts upon any and all secure transport errors or
 >       warnings, including those caused by a site presenting self-signed
 >       certificates

 If a self-signed certificate does not cause a secure transport error,
 then you're all set.  For example, it's fine for a self-signed
 certificate to be in the list of explicitly trusted certificates.  In
 that case, no secure transport error is generated.  Try it.  :)

 > Knowing that HSTS allows any validation method a posteriori allows you
 > interpret this correctly - that self-signed certs *may* be allowed
 > under HSTS, if the user has added them to their store.  But without
 > that, it may be interpretted incorrectly - that no self-signed certs
 > would be allowed.

 That's not what it says.

 > Furthermore, I'm not sure, but "any and all secure
 > transport errors or warnings" may be ambiguous.  I don't know if it's
 > an existing standard to enter a warning or error state in event of
 > (for example) a revocation check failure - although we do know that
 > most browsers do not present any warning or error.  There's more on
 > that in Adam Langley's thread.   If HSTS does not define whether or
 > not a revocation check failure is an error condition, I think it
 > should.

 Indeed.  A reference there would be helpful.

-- 
-------------------------------------------+--------------------------------
 Reporter:  jeff.hodges@…                  |       Owner:  =JeffH
     Type:  defect                         |      Status:  new   
 Priority:  major                          |   Milestone:        
Component:  strict-transport-sec           |     Version:        
 Severity:  Active WG Document             |    Keywords:        
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/9>
websec <http://tools.ietf.org/websec/>

[websec] #9: explicitly note revocation check fai… websec issue tracker
Re: [websec] #9: explicitly note revocation check… websec issue tracker