Subject: [keyassure] [dane] #23: Asserting DANE exclusivity for an entire domain

From: "dane issue tracker" <[email-masked]>
Date: Mon, 21 Mar 2011 19:32:33 -0000

#23: Asserting DANE exclusivity for an entire domain

 I would like to be able to assert DANE exclusivity for an entire domain so
 that, with respect to clients that check DANE first and fall back to a
 mainstream public CA list, a public CA cannot fabricate a TLS service I do
 not offer.

 Previously discussed in [http://www.ietf.org/mail-
 archive/web/keyassure/current/msg01641.html this thread], but no final
 decision was reached.

 One approach to achieve this is to compose (1) a means of asserting the
 nonexistence of a TLS service at a (hostname, transport, port) triple and
 (2) a means of applying such an assertion to an entire domain except where
 otherwise specified.  Zack Weinberg made a reasonable proposal for (1):
 use a single RR with "certificate type" 0 and no "certificate for
 association".  (2) can be done with DNSSEC wildcards, but that is a little
 messy and will seriously bloat the zone if several different RRtypes each
 require this treatment.

-- 
------------------------------------+---------------------------------------
 Reporter:  matt@…                  |       Owner:     
     Type:  enhancement             |      Status:  new
 Priority:  major                   |   Milestone:     
Component:  protocol                |     Version:     
 Severity:  -                       |    Keywords:     
------------------------------------+---------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/23>
dane <http://tools.ietf.org/dane/>

---

From: Paul Wouters <[email-masked]>
Date: Mon, 21 Mar 2011 15:50:33 -0400 (EDT)

> mainstream public CA list, a public CA cannot fabricate a TLS service I do

Could this not be done by adding an "empty" CAA record?

Also, is this not what people here call "dictating policy to the client" ?

Paul

---

From: Matt McCutchen <[email-masked]>
Date: Mon, 21 Mar 2011 15:56:52 -0400

> Could this not be done by adding an "empty" CAA record?

CAA is not DANE.

> Also, is this not what people here call "dictating policy to the client" ?

I responded to this objection the first time it was raised.

http://www.ietf.org/mail-archive/web/keyassure/current/msg01700.html

-- 
Matt