Subject: Re: [keyassure] I-D Action:draft-ietf-dane-protocol-00.txt

From: "Jeffrey A. Williams" <[email-masked]>
Date: Sat, 18 Dec 2010 11:30:17 -0600 (GMT-06:00)

Steve and all,

-----Original Message-----
>From: Steve Schultze <[email-masked]>
>Sent: Dec 17, 2010 5:55 PM
>To: [email-masked]
>Subject: Re: [keyassure] I-D Action:draft-ietf-dane-protocol-00.txt
>
>On Dec 17, 2010, at 4:27 PM, James Cloos wrote:
>>>>>>> "MM" == Matt McCutchen <[email-masked]> writes:
>> 
>>>> For that to work, a lack of dns trust has to fall back to the collection
>>>> of root CAs model.
>> 
>> MM> And that works fine when the client gets a "secure" DNSSEC result with
>> MM> zero TLSA records or an "insecure" result.  On the other hand, a "bogus"
>> MM> result means the system is misconfigured or under attack.  I don't see
>> MM> why there is a demand that the system continue to function in such an event.
>> 
>> Unless the client previously noted that a given remote uses DANE, how
>> can it tell that a non-secure DNS lookup is a MITM attack and not just
>> a legacy site?
>
>It can't.  According to Matt's suggested text:
>
>'...if any query gives an "insecure" or "indeterminate" result, KIDNS cannot be used with this TLS server, and the client MAY use an alternative certificate validation method.'

  Right!  And this IMO proposes a problem in that a the PKI method
vis "Trust Anchors" leaves some in a no win or no operation position
which seems extremely odd to me.  So what other standardized certification
validation method will there be? 
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
Network Eng. SR. Eng. Network data security
ABA member in good standing member ID 01257402 
E-Mail [email-masked]
Phone: 214-244-4827