Re: [websec] #39: appropriately acknowlege and accommodate DANE

Paul Hoffman <paul.hoffman@vpnc.org> Fri, 20 April 2012 18:49 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFA5721F8652 for <websec@ietfa.amsl.com>; Fri, 20 Apr 2012 11:49:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.53
X-Spam-Level:
X-Spam-Status: No, score=-102.53 tagged_above=-999 required=5 tests=[AWL=0.069, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dPo9ZH3+j1RQ for <websec@ietfa.amsl.com>; Fri, 20 Apr 2012 11:49:06 -0700 (PDT)
Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2605:8e00:100:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id 2A31F21F864F for <websec@ietf.org>; Fri, 20 Apr 2012 11:49:06 -0700 (PDT)
Received: from [10.20.30.103] (50-0-66-4.dsl.dynamic.fusionbroadband.com [50.0.66.4]) (authenticated bits=0) by hoffman.proper.com (8.14.5/8.14.3) with ESMTP id q3KIn4Cg049289 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Fri, 20 Apr 2012 11:49:05 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: text/plain; charset=us-ascii
From: Paul Hoffman <paul.hoffman@vpnc.org>
In-Reply-To: <4F91A1F8.4090501@KingsMountain.com>
Date: Fri, 20 Apr 2012 11:49:04 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <5508DE4C-67E1-48F0-8B85-686741E6C0BA@vpnc.org>
References: <4F91A1F8.4090501@KingsMountain.com>
To: =JeffH <jeff.hodges@kingsmountain.com>
X-Mailer: Apple Mail (2.1257)
Cc: IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] #39: appropriately acknowlege and accommodate DANE
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Apr 2012 18:49:06 -0000

On Apr 20, 2012, at 10:50 AM, =JeffH wrote:

> > #39: appropriately acknowlege and accommodate DANE
> http://trac.tools.ietf.org/wg/websec/trac/ticket/39
> 
> 
> fyi & comment, the text I presently have in my working copy of -07 is..
> 
>                     .
>                     .
>                     .
> 2.2.  HTTP Strict Transport Security Policy Effects
> 
>   The effects of the HTTP Strict Transport Security (HSTS) Policy, as
>   applied by a UA in interactions with a web resource host wielding
>   such policy (known as a HSTS Host), are summarized as follows:
>                     .
>                     .
>   2.  The UA terminates any secure transport connection attempts upon
>       any and all secure transport errors or warnings, including those
>       caused by a web application presenting a certificate matching a
>       trusted certificate association as denoted via the DANE protocol
>       [I-D.ietf-dane-protocol], or any other form of self-signed
>       certificate that does not chain to a trust anchor in the UA or
>       operating system CA root certificate store.

I don't think this is what you meant. It sounds like that using DANE is considered a transport error or warning. Proposed fix:

   2.  The UA terminates any secure transport connection attempts upon
       any and all secure transport errors or warnings, including those
       caused by a web application presenting self-signed certificates
       that do not chain to a trust anchor in the UA or operating system
       CA root certificate store, except when the self-signed certificate
       is part of a validated certificate association as defined in
       [I-D.ietf-dane-protocol].

--Paul Hoffman