Re: [websec] #39: appropriately acknowlege and accommodate DANE

[=JeffH <[e-mail]>]

Paul Hoffman noted:
 > On Apr 20, 2012, at 10:50 AM, =JeffH wrote:
 >
 >> > #39: appropriately acknowlege and accommodate DANE
 >> http://trac.tools.ietf.org/wg/websec/trac/ticket/39
 >>
 >>
 >> fyi & comment, the text I presently have in my working copy of -07 is..
 >>
 >>                     .
 >>                     .
 >>                     .
 >> 2.2.  HTTP Strict Transport Security Policy Effects
 >>
 >>   The effects of the HTTP Strict Transport Security (HSTS) Policy, as
 >>   applied by a UA in interactions with a web resource host wielding
 >>   such policy (known as a HSTS Host), are summarized as follows:
 >>                     .
 >>                     .
 >>   2.  The UA terminates any secure transport connection attempts upon
 >>       any and all secure transport errors or warnings, including those
 >>       caused by a web application presenting a certificate matching a
 >>       trusted certificate association as denoted via the DANE protocol
 >>       [I-D.ietf-dane-protocol], or any other form of self-signed
 >>       certificate that does not chain to a trust anchor in the UA or
 >>       operating system CA root certificate store.
 >
 > I don't think this is what you meant. It sounds like that using DANE is 
considered a transport error or warning. Proposed fix:
 >
 >    2.  The UA terminates any secure transport connection attempts upon
 >        any and all secure transport errors or warnings, including those
 >        caused by a web application presenting self-signed certificates
 >        that do not chain to a trust anchor in the UA or operating system
 >        CA root certificate store, except when the self-signed certificate
 >        is part of a validated certificate association as defined in
 >        [I-D.ietf-dane-protocol].


thanks.

hm...

In looking at this section, which is attempting to only (non-normatively) 
summarize the effects of the HSTS policy, it occurs to me it should be 
streamlined down to..


    2.  The UA terminates any secure transport connection attempts upon
        any and all secure transport errors or warnings.


..because section 10.2 now addresses details wrt "self-signed certs" and such.


Section 2.2 in my working copy is now..

###
2.2.  HTTP Strict Transport Security Policy Effects

    The effects of the HTTP Strict Transport Security (HSTS) Policy, as
    applied by a conformant UA in interactions with a web resource host
    wielding such policy (known as a HSTS Host), are summarized as
    follows:

    1.  UAs transform insecure URI references to a HSTS Host into secure
        URI references before dereferencing them.

    2.  The UA terminates any secure transport connection attempts upon
        any and all secure transport errors or warnings.
###


=JeffH