Subject: [dane] TLS server authentication schemes...

From: Matt McCutchen <[email-masked]>
Date: Fri, 10 Jun 2011 20:19:19 -0400

On Fri, 2011-06-10 at 15:58 -0700, Ed Gerck, Ph.D. wrote:
> On 6/10/2011 2:37 PM, Matt McCutchen wrote:
> >    DANE
> > does not redefine PKIX semantics in any way.
> 
> Yes,
> DANE redefines the PKIX semantics
> 
> Why?
> 
> DANE defines a different way (ie, different meaning, different semantics)
> to authenticate the association of  the server's certificate with the intended
> domain name, and is done without trusting an external  CA. [1]

The first statement does not follow from the second.  PKIX is still what
it is; DANE is merely an alternative.  The claim that DANE "redefines"
PKIX seems to be a deduction from the faulty premise that PKIX is the
only possible method of TLS server authentication, and thus the only way
to do differently is to change PKIX.

> > DANE has significant security advantages over PKIX under a set of
> > assumptions that are controversial.
> 
> Intuitively, as more witnesses are considered, it becomes less likely that all 
> witnesses
> can be compromised at the same time. More Witnesses = Better Evidence. [2]
> 
> DANE reduces the number of witnesses over what is needed with PKIX, hence it
> can be more easily compromised.  Hence, it is not desirable.
> 
> In other words, exactly because the same DNS administrator for a domain name is
> authorized under DANE to *both* give identifying information about the zone and
> make an authoritative binding between the domain name and a certificate, it should
> be less trustworthy. Trust cannot be earned by self-assertions [2].

This debate has gone around and around on the DANE list, and it is not
productive because the two sides argue from different assumptions that
they are unwilling or unable (for lack of data) to reconcile.  Suffice
it to say that a number of people wish to use DANE, so we are proceeding
with the standardization.

> >   OTOH, I have not seen any
> > substantive claim of an advantage of the CAA RP support over DANE.
> 
> As above.

I do not understand what you mean.  Please spell it out.

-- 
Matt

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 10 Jun 2011 23:43:13 -0400

Since people are proposing to define restriction semantics on existing PKIX
certificates using DANE they are proposing to change the validity and thus
the semantics of PKIX.

I do not see any possibility of a collision between DANE semantics and
anything that is agreed in PKIX because I cannot see any possibility of DANE
getting a standards track RFC published that attempts to perform the
restriction being proposed.

If people want to get anywhere with DANE they are going to have to first
develop a mechanism that is capable of key distribution without affecting
any existing infrastructure whatsoever. Only after that has been achieved
and deployed and is in use can I see a proposal such as the cert restriction
semantics having credibility outside the DANE working group.

It is really, really easy to propose security schemes in theory. You can
sweep all the hard parts under the rug and hope nobody notices. Or you can
attack the motives of people who have had prior experience and hope they
eventually go away.

Publishing keys is a really hard problem all by itself. But the only way
people are going to believe how hard it is is when they start to deploy.

I certainly find it rather odd that the people who are so terrified of scope
creep that they only want to think about TLS want to combine key
distribution with restricting keys issued in a completely different PKI. So
they end up having to consider the ambiguities and complexities of legacy
DNS deployment due to using DNSSEC and then on top of that they want to add
in all the complexities of PKIX.

I guess that it might roll out the way people here imagine but I think it
rather more likely that the result of trying to start a turf war on this is
going to be an applicability statement that prohibits DANE making any
assertion relating to non-DANE PKIX certs.

On Fri, Jun 10, 2011 at 8:19 PM, Matt McCutchen <[email-masked]>wrote:

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

-- 
Website: http://hallambaker.com/

---

From: Martin Rex <[email-masked]>
Date: Sat, 11 Jun 2011 06:27:22 +0200 (MEST)

> semantics having credibility outside the DANE working group.

I believe the IETF should let the consumer / the market decide
how much of PKIX and how much of DANE they want.

IMO, PKIX might has too much of a bias to make such a decision.

DANE is _not_ about inventing a whole new technology infrastructure
from ground up, but about making an emerging and useful infrastructure
even more useful by offering additional benefits.

DANE is primarily about trust anchor management and path constraints
management for the internet, something we I, personally, do not believe
we have any reliable working solution for -- today.

If you think that the existing thing known as the
"TLS X.509 PKI of commercial CAs" is as valuable and reliable
as you want to make us believe, then there is really nothing
that you have to worry about from the part of DANE.  ;-)

-Martin

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 11 Jun 2011 08:04:28 -0700

On Jun 10, 2011, at 8:43 PM, Phillip Hallam-Baker wrote:

> Since people are proposing to define restriction semantics on existing PKIX certificates using DANE they are proposing to change the validity and thus the semantics of PKIX.

Lord knows this is probably foolish, but let me try again:

You talk about "semantics of PKIX", but you don't say which you mean. Can you possibly send some quotes from RFC 5280 to help us understand what you mean? If not, can you tell us why you think that unwritten ideas should be considered here? Thanks in advance.

--Paul Hoffman

---

From: Matt McCutchen <[email-masked]>
Date: Sat, 11 Jun 2011 19:00:58 -0400

For now, I'll respond to one point:

On Sat, 2011-06-11 at 09:55 -0400, Phillip Hallam-Baker wrote:
> Nowhere does the charter state that DANE is going to make statements
> about certificates.

Incorrect.  The charter says, "allowing flexibility for all
key-transport mechanisms supported by the application protocols
addressed (e.g., both self-signed and CA-issued certificates for use in
TLS)".  The purpose of using the term "keys" is to be general to
protocols that rely on key-name bindings but do not use certificates.

-- 
Matt

---

From: "Ed Gerck, Ph.D." <[email-masked]>
Date: Fri, 10 Jun 2011 18:30:52 -0700

On 6/10/2011 5:19 PM, Matt McCutchen wrote:
>> Yes, DANE redefines the PKIX semantics
>> Why?
>>

The first statement makes no claim on an authoritative source.  The fact that 
folks can
*redefine* the semantics of English so that "cool" means "hot" does not mean that
English is authoritatively changed.

In this case, because DANE changes what it means to "authenticate the server
certificate" (which has so far been defined by PKIX semantics), DANE is indeed
*redefining* the meaning (semantics) that people assign to that sentence.  We now
have two angles to understand the sentence "authenticate the server certificate" .
The DANE and the PKIX angles.

Now, while this may add some degree of confusion (which angle is the browser
using?), I do not say that this is bad or "impossible".  What I say is not that 
this is by
itself bad but that it is not desirable, and I explained why below.

> with the standardization.

My argument did not hinge on popularity.  A number of people may wish to use 
what is
more likely to fail for a number of reasons, including cost.  My argument was that
security-wise DANE is less trustworthy and I explained why using intuitive, 
historical, and
formal arguments. It's not just a theory or an anecdote.

> I do not understand what you mean.  Please spell it out.

Security-wise, DANE is less trustworthy.

Thank you for your comments.

Cheers,
Ed Gerck