Re: [keyassure] Using trust anchor language

"Steingruebl, Andy" <asteingruebl@paypal-inc.com> Thu, 27 January 2011 18:12 UTC

DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:CC: Date:Subject:Thread-Topic:Thread-Index:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: x-ems-proccessed:x-ems-stamp:Content-Type: Content-Transfer-Encoding:MIME-Version:X-CFilter; b=QfnAXelGMs2/De0U5zltQxjUNOiozG2xr3nIWZvf9QlpHBX0VEr4nxpl Xu4H1PZAMrEJoWHOZLY4GTqKPiYqpAPjdU52uGvzO70QnsAt5Vt7952fH ibkESPpjfqf0luR;
From: "Steingruebl, Andy" <asteingruebl@paypal-inc.com>
To: Stephen Kent <kent@bbn.com>
Date: Thu, 27 Jan 2011 11:13:57 -0700
Thread-Topic: [keyassure] Using trust anchor language
Thread-Index: Acu+SlVeuNGcV3B0TV6MjtWcY8V1ggAAve4w
Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEB1A2F1A36@DEN-MEXMS-001.corp.ebay.com>
References: <mailman.75.1295985619.11993.keyassure@ietf.org> <4D404B76.7010702@gmail.com> <4D4052C8.3060308@vpnc.org> <AANLkTiniYvX9to86y3ya0HcPpE7_MBkmYgTWUNC2kW5f@mail.gmail.com> <4D4182E6.1000908@vpnc.org> <p06240802c967386692da@[192.1.255.194]> <alpine.LFD.1.10.1101271111460.19497@newtla.xelerance.com> <p0624080cc9675482299c@[192.1.255.194]> <5EE049BA3C6538409BBE6F1760F328ABEB1A2F19B2@DEN-MEXMS-001.corp.ebay.com> <p0624080ec9675ef30027@[192.1.255.194]>
In-Reply-To: <p0624080ec9675ef30027@[192.1.255.194]>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "keyassure@ietf.org" <keyassure@ietf.org>
Subject: Re: [keyassure] Using trust anchor language
Precedence: list

> -----Original Message-----
> From: Stephen Kent [mailto:kent@bbn.com]
> 
> Sorry for being dense, but can you explain how the SNI extension and IP
> exhaustion relate to the issue of extracting a DNS name from a cert vs.
> inferring it from the DNS record?

Ordinarily, in order to host multiple TLS-endpoints (web virtual hosting) on a single-IP, you have two choices:

1. A cert with multiple SANs
2. use SNI so a client can indicate which end-endpoint (hostname) it is trying to reach.

#1 is extremely problematic when virtual-hosting services for different entities, or lots of entities.  For example, CDNs will often try to virtual a number of websites at the same IP, and will have a certificate with SANs that span a multitude of organizations/businesses.

#2 is problematic because SNI isn't supported in Windows-XP.

Currently, #1 or a single-IP per "website/hostname" is required.

With TLSA if we don't have to embed the hostname in the certificate offered during the TLS handshake, we don't care about SNI if a client supports TLSA.  Now, what client will support TLSA and not SNI, well, that's why this isn't really that big a deal I suppose..

- Andy

Re: [keyassure] Using trust anchor language Yaron Sheffer
Re: [keyassure] Using trust anchor language Jakob Schlyter
Re: [keyassure] Using trust anchor language Zack Weinberg
Re: [keyassure] Using trust anchor language Yaron Sheffer
Re: [keyassure] Using trust anchor language Paul Hoffman
Re: [keyassure] Using trust anchor language Paul Hoffman
Re: [keyassure] Using trust anchor language Stephen Kent
Re: [keyassure] Using trust anchor language Stephen Kent
Re: [keyassure] Using trust anchor language Paul Wouters
Re: [keyassure] Using trust anchor language Stephen Kent
Re: [keyassure] Using trust anchor language Steingruebl, Andy
Re: [keyassure] Using trust anchor language Stephen Kent
Re: [keyassure] Using trust anchor language Steingruebl, Andy
Re: [keyassure] Using trust anchor language Martin Rex
Re: [keyassure] Using trust anchor language Yaron Sheffer
Re: [keyassure] Using trust anchor language Martin Rex
Re: [keyassure] Using trust anchor language Carl Wallace
Re: [keyassure] Using trust anchor language Yaron Sheffer
Re: [keyassure] Using trust anchor language Stephen Kent