Subject: Re: [saag] Whether TOFU should be considered in secure DHCPv6?

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 31 Aug 2016 22:46:05 -0400

> On Aug 31, 2016, at 9:42 PM, Randy Bush <[email-masked]> wrote:
> 
> what is authenticated?  tofu and authentication are antithetical.

Except for (allegedly) EV certs, the entire Web PKI runs on TOFU,
except that it happens invisibly (swept under the rug) between the
CA and the purported domain owner.

Thus DV certs are TOFU for public consumption, where the CA gets
to regurgitate the same TOFU to feed all the relying parties.

-- 
	Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 31 Aug 2016 23:01:30 -0400

> On Aug 31, 2016, at 10:46 PM, Viktor Dukhovni <[email-masked]> wrote:
> 

I should perhaps add that the problem with TOFU is not so much
that is especially weak authentication, but rather that is much
too fragile for peering to a large number of peers.

When uses TOFU for SSH to a small set of servers, or to connect
to a small, mostly stable set of networks, it can be a reasonable
fit.  When one uses TOFU with a large dynamic set of peers with
keys relatively frequently becoming stale TOFU, then it becomes
a rather poor user experience, and is counter-productive.

-- 
	Viktor.

---

From: Ted Lemon <[email-masked]>
Date: Wed, 31 Aug 2016 23:15:48 -0400

The UX for ToFU depends on the use model.   For DHCP, the use model I would
expect to be most common would be "if I have a choice between a server I
talked to before that worked, and a server whose claimed identity can't be
checked either because no authentication or because never seen before, pick
the one I've seen before that worked."   So it would be interesting to
answer the question, does this make things worse or better in practice?   I
think better, but I'm curious to see what sort of opprobrium will rain down
on me for putting forth that theory. :)