Subject: [pkix] draft-ietf-pkix-caa-04 submitted

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 13 Feb 2012 10:49:15 -0500

This is mostly edits to correct a bunch of nits substantive changes are:

* The IODEF reporting mechanism is documented
* Have added in ABNF for the property field encoding to separate the
private use area from the rest
* Removed remaining client side enforcement stuff
* Added notes to guide use by projects like convergence, EFF
observatory etc. pointing out limitations
* Have added previously defined but obsolete properties to list as 'reserved'
* Cleaned up the IANA part

At this point I think the doument itself is almost ready to go. The
main thing that needs to be done is to run an ABNF checker tool over
the examples.

-- 
Website: http://hallambaker.com/

---

From: "Manger, James H" <[email-masked]>
Date: Tue, 14 Feb 2012 11:42:59 +1100

Phillip,

If a CA is asked to issue a cert to a.b.c.example.com I assume it should look for CAA records in the following 4 domains, stopping as soon as it finds some:
  a.b.c.example.com
    b.c.example.com
      c.example.com
        example.com

However, draft-ietf-pkix-caa-04 says [§3] to look at the canonical form of a domain name, then the public delegation point. That would only be:
  a.b.c.example.com
        example.com

On a minor issue, the ABNF for value [§4.2] will not work:
  value = *VCHAR | DQUOTE *(%x20-21 / %x23-7E) DQUOTE

VCHAR is %x21-7E, which includes DQUOTE and ";" that makes parsing ambiguous.
How about allowing printable ASCII, excluding space, quote, and semicolon:
  value = *(%x21 / %x23-3A / %x3C-7E)

--
James Manger

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 14 Feb 2012 18:36:33 -0500

Thanks,

The testing only at the canonical domain and the delegation point is deliberate. The CAs do maintain lists of public delegation points and 90+% is met by a a policy covering the whole domain in any case. The only reason for looking at the canonical domain is that it allows for exceptions to be special cased. 

Checking all the way up would increase the work for the CA and in particular the records keeping.

I will fix the ABNF. 

Sent from my iPad

---

From: "Manger, James H" <[email-masked]>
Date: Wed, 15 Feb 2012 11:07:10 +1100

> The testing only at the canonical domain and the delegation point is deliberate. The CAs do maintain lists of public delegation points and 90+% is met by a a policy covering the whole domain in any…

That makes some sense. However, are "public delegation points" well enough defined? I assume these are the same as public suffixes [http://publicsuffix.org/]. Lists of these exist, but they feel a little fuzzy and ad hoc. I doubt everyone’s list is the same at any point in time. For instance, will this rule mean a whole Government can specify a CA policy, but particular Government departments cannot?

> Checking all the way up would increase the work for the CA and in particular the records keeping.

Would it really increase noticeably? My guess (without any data) is that most certs (perhaps the vast majority) are like www.example.com or example.com that have no extra layers in between to check?

--
James Manger

-----

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 14 Feb 2012 21:15:37 -0500

> That makes some sense. However, are "public delegation points" well enough defined? I assume these are the same as public suffixes [http://publicsuffix.org/]. Lists of these exist, but they feel a…

The delegation points are a well known issue in the CA world already.
Has to be because the authentication callback email has to go there...

Government departments are pretty much the only case I can see where
there would likely be a real requirement to support multiple issuers.
I guess we could go to a three step approach...

> Would it really increase noticeably? My guess (without any data) is that most certs (perhaps the vast majority) are like www.example.com or example.com that have no extra layers in between to check?

I see no problem at all checking for reasonable cases. It is edge
cases like a.b.c.d.e.f.g.h.i.j....com that worry me.

I know the DNS makes it possible to set up such domains but I see
absolutely no need to support them...

The issue here is the way we write and test security code. I am much
happier with a limited set of three test cases than having to support
an 200+ of them.

---

From: "Henry B. Hotz" <[email-masked]>
Date: Wed, 15 Feb 2012 09:54:17 -0800

On Feb 14, 2012, at 6:15 PM, Phillip Hallam-Baker wrote:

>> Would it really increase noticeably? My guess (without any data) is that most certs (perhaps the vast majority) are likewww.example.com or example.com that have no extra layers in between to check?
> 

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 15 Feb 2012 11:41:36 -0800

>>>>> On Tue, 14 Feb 2012 18:36:33 -0500, Phillip Hallam-Baker <[email-masked]> said:

PH> Checking all the way up would increase the work for the CA and in
PH> particular the records keeping.

The work is trivial (we're talking seconds wall-clock, and micro-seconds
for actual CPU time considering it's really just waiting for network traffic).

What's the record keeping concern of which you speak?  Are you saying
that it's intensive to document all the places you didn't find anything
but did check?  Even if you were going to packet log everything you sent
and received, we're still only talking about minuscule amounts of bytes.
-- 
Wes Hardaker                                     
My Pictures:  http://capturedonearth.com/
My Thoughts:  http://pontifications.hardakers.net/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 17 Feb 2012 12:32:09 -0500

The CA should keep logs of all DNS RRs that are signed using DNSSEC.
So there would be a sequence of NSEC3 records showing the non
existence of the intermediate nodes.

It is probably more relevant if the check was happening in real time
though. I'll modify the text to specify check everything unless
someone objects.