Subject: [dane] I-D Action: draft-ietf-dane-protocol-13.txt

From: [email-masked]
Date: Mon, 19 Dec 2011 08:01:39 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS-based Authentication of Named Entities Working Group of the IETF.

	Title           : Using Secure DNS to Associate Certificates with Domain Names For TLS
	Author(s)       : Paul Hoffman
                          Jakob Schlyter
	Filename        : draft-ietf-dane-protocol-13.txt
	Pages           : 20
	Date            : 2011-12-19

   TLS and DTLS use PKIX certificates for authenticating the server.
   Users want their applications to verify that the certificate provided
   by the TLS server is in fact associated with the domain name they
   expect.  TLSA provides bindings of keys to domains that are asserted
   not by external entities, but by the entities that operate the DNS.
   This document describes how to use secure DNS to associate the TLS
   server's certificate with the intended domain name.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dane-protocol-13.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-dane-protocol-13.txt

---

From: Scott Schmit <[email-masked]>
Date: Sat, 24 Dec 2011 15:29:12 -0500

On Mon, Dec 19, 2011 at 08:01:39AM -0800, [email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the DNS-based Authentication
> of Named Entities Working Group of the IETF.
> 

This draft lost the fallback text explaining what to do when there
are no usable certificate associations.

-- 
Scott Schmit

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 24 Dec 2011 16:17:34 -0800

> are no usable certificate associations.

Quite true. We were simply following directions from the chairs. Would anyone object if we add the following:
   If an	 		
   application receives zero usable certificate associations, it	 		
   processes TLS in the normal fashion; otherwise, that application	 		
   attempts to match each certificate association with the TLS server's	 		
   end entity certificate.

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Dec 2011 13:54:00 -0500

>   attempts to match each certificate association with the TLS server's            

No objections, LGTM++, etc.

W

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

---

From: Paul Wouters <[email-masked]>
Date: Mon, 26 Dec 2011 18:09:51 -0500 (EST)

>   attempts to match each certificate association with the TLS server's

Would this behaviour be different depending on whether this
non-existence was validated versus indeterminate?

Paul