Subject: [dane] Certificate Usage 2 with revoked trust anchor certificate

From: Christian Becker <[email-masked]>
Date: Wed, 22 May 2013 11:13:42 +0200

Hi,

what is the intended outcome validating a record TLSA 2 x x, where the
specified trust anchor certificate was already revoked by a CA? Does
PKIX certification path validation include revocation checks?

RFC 6698 says "The target certificate MUST pass PKIX certification path
validation, with any certificate matching the TLSA record considered to
be a trust anchor for this certification path validation."

Thanks,
Christian

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 22 May 2013 13:06:26 +0000

> PKIX certification path validation include revocation checks?

With certificate usages "2" and "3" there is no PKIX validation
above the trust-anchor or EE certificate respectively.  The party
publishing the TLSA RR is responsible for updating the TLSA record
when the certificate in question is no longer trustworthy.  This
is properly a responsibility of the domain owner, I should add a note
about this to the next revision of the ops draft...

Any other feedback for the draft?

> be a trust anchor for this certification path validation."

Trust anchors can't be revoked, the verifier has to remove to them
from their trust store.  With DANE the picture is better, the domain
owner can do this once for all verifiers by publishing a new TLSA
RRset that uses a non-compromised TA.

-- 
	Viktor.

---

From: Christian Becker <[email-masked]>
Date: Wed, 22 May 2013 15:31:21 +0200

> about this to the next revision of the ops draft...

Thanks for your answer. I only supposed that there is or should be an
answer on the protocol level as well to this situation where there might
be conflicting information from PKIX validation and DANE.

Christian

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 22 May 2013 15:50:25 +0000

> be conflicting information from PKIX validation and DANE.

The whole point of "2" and "3" is that the existing public CA PKI
(I think that's what you mean by PKIX) is out of scope, neither
trusted nor consulted.  Thus a DANE trust anchor with usage 2/3 is
never revoked, it is simply replaced by the domain owner publishing
updated TLSA records.

>From where I sit, this is much better than revocation lists, OCSP,
...  Eventually the TA is domain issued (not just a transitional
reference to a public CA) and so updating the DNS is a simple local
matter, more convenient than pushing revocations to a CA.

The operational requirement is to avoid excessively long signature
validity, which means resigning the DNS zone at least daily for
sites with high value keys.  For my personal domain, weekly resigning
will likely do just fine.

-- 
	Viktor.