Subject: Re: [dane] DNSSEC optionality (was: Starting WGLC on: draft-ietf-dane-use-cases-02)

From: =JeffH <[email-masked]>
Date: Fri, 13 May 2011 09:33:29 -0700

Both PaulW and JimS note that the security analysis of the S3.1 CA Constraints 
use case attempts to justify the optionality of DNSSEC..

Paul Wouters:
http://www.ietf.org/mail-archive/web/dane/current/msg02559.html

Jim Schaad
http://www.ietf.org/mail-archive/web/dane/current/msg02564.html

In overall support of their views, I although note that the security analysis 
of the S3.1 CA Constraints use case could be updated to not state a requirement 
(DNSSEC optionality), and to more thoroughly analyze the case (as they both 
have done).

I agree that there doesn't appear to be very much of a justification for 
deploying DANE records is one isn't going to do so securely, and this should be 
made clear in some fashion.

However, having a MUST functional requirement of performing DNSSEC validation 
by the application service client is not possible to satisfy in general today 
and for the forseeable future due to the so-called "DNSSEC last-mile problem". 
So realistically it should be a SHOULD and this last-mile issue noted.

=JeffH

---

From: Chris Palmer <[email-masked]>
Date: Sat, 14 May 2011 01:10:09 -0500

On May 13, 2011, at 11:33 AM, =JeffH wrote:

> I agree that there doesn't appear to be very much of a justification for deploying DANE records is one isn't going to do so securely, and this should be made clear in some fashion.

In my view, DANE (or something like it) is the reason for DNSSEC to exist.

And if it's not end-to-end (i.e. if the last mile problem is not solved), then...

-- 
Chris Palmer
Technology Director, Electronic Frontier Foundation
https://www.eff.org/code

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 14 May 2011 18:29:31 +1200

>In my view, DANE (or something like it) is the reason for DNSSEC to exist.

Nice.  That's like the 21st-century update to "PKI needs electronic commerce 
in order to function".

Peter.

---

From: Lawrence Conroy <[email-masked]>
Date: Sat, 14 May 2011 15:52:35 +0100

Hi Peter,
 There's enough confusion already -- That is exactly the opposite of what I understood Chris to say.
To re-phrase, "Electronic commerce (or something like it)^^ is the reason for PKI to exist."

^^ IETF people are plumbers, so the nearest we get to apps is the protocols those apps can use (and use case docs).
all the best,
  Lawrence

---

From: Peter Gutmann <[email-masked]>
Date: Sun, 15 May 2011 09:58:52 +1200

>To re-phrase, "Electronic commerce (or something like it)^^ is the reason 

I think we're saying the same thing... what I was pointing out was that 
throughout the 1990s we were told:

  "e-commerce needs PKI in order to function"

Someone (I think it was Carl Ellison) then pointed out that it was really:

  "PKI needs e-commerce in order to function"

Chris' comment seemed to be a similar reversal for DNSSEC and DANE, instead of 
it being "DNSSEC drives DANE" it was "DANE drives DNSSEC" (DANE works just as 
well without DNSSEC, in the same way that e-commerce works just as well 
without PKI).

Peter.