Subject: [dane] #31: Multiple TLSA records in a response

From: "dane issue tracker" <[email-masked]>
Date: Wed, 17 Aug 2011 15:38:42 -0000

#31: Multiple TLSA records in a response

 The document never actually states the semantics of what it means when a
 single DNS request returns multiple TLSA records. It should.

-- 
-----------------------------------+----------------------------------------
 Reporter:  paul.hoffman@…         |       Owner:  draft-ietf-dane-protocol@…             
     Type:  defect                 |      Status:  new                                    
 Priority:  major                  |   Milestone:                                         
Component:  protocol               |     Version:                                         
 Severity:  -                      |    Keywords:                                         
-----------------------------------+----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/31>
dane <http://tools.ietf.org/dane/>

---

From: "dane issue tracker" <[email-masked]>
Date: Wed, 17 Aug 2011 15:43:29 -0000

Comment(by paul.hoffman@…):

 Proposal: in section 4.4, add a short paragraph that says "A domain name
 can have more than one TLSA record. A typical use for multiple TLSA
 records would be when the site is changing from one certificate to
 another. If a DNS response contains multiple TLSA records, any record from
 the set returned can be used to make certificate associations."

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/31#comment:1>
dane <http://tools.ietf.org/dane/>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 18 Aug 2011 18:49:24 +0100

Should probably add in a caution here to the effect that if the number of
records returned is prohibitively large, clients and middleboxen may not
accept the response (possible DoS attack). So publishers of records should
probably use the cert signing approach there.

On Wed, Aug 17, 2011 at 4:43 PM, dane issue tracker <
[email-masked]> wrote:

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

-- 
Website: http://hallambaker.com/