Subject: I-D Action: draft-barnes-dane-uks-00.txt

From: [email-masked]
Date: Sun, 09 Oct 2016 20:56:23 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : Unknown Key-Share Attacks on DNS-based Authentications of Named Entities (DANE)
        Authors         : Richard Barnes
                          Martin Thomson
                          Eric Rescorla
	Filename        : draft-barnes-dane-uks-00.txt
	Pages           : 9
	Date            : 2016-10-09

Abstract:
   Unknown key-share attacks are a class of attacks that allow an
   attacker to deceive one peer of a secure communication as to the
   identity of the remote peer.  When used with traditional, PKI-based
   authentication, TLS-based applications are generally safe from
   unknown key-share attacks.  DNS-based Authentication of Named
   Entities (DANE), however, proposes that applications perform a
   different set of checks as part of authenticating a TLS connection.
   As a result, DANE as currently specified is likely to lead to unknown
   key-share attacks when clients support DANE for authentication.  We
   describe these risks and some simple mitigations.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-barnes-dane-uks/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-barnes-dane-uks-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/