>>>>> "Viktor" == Viktor Dukhovni <ietf-dane@xxxxxxxxxxxx> writes:
Viktor> On Tue, Feb 24, 2015 at 08:49:29AM -0800, Paul Hoffman wrote:
>> On Feb 23, 2015, at 8:33 AM, Sam Hartman <hartmans-ietf@xxxxxxx> wrote:
>> > Yes, I see significant security problems with this URI.
>>
>> It sounds like you have issues with URIs in general, not in a DNS
>> RTYPE that carries a URI. That is, any URI that has a domain name
>> that can lead to redirection (though CNAME, DNAME, or SRV) would
>> have the properties that worry you. It that a fair summary?
Viktor> That's not how I read it. The issue here is that the draft
Viktor> introduces a DNS-based rewrite of the TLS reference
Viktor> identifier.
Victor is correct. This draft introduces indirection through DNS.
Typically in the past when we've done indirection through DNS, we've not
changed the expected security principal that we're targeting.
It's that change that significantly changes the security model.
There are times when an indirection through a trusted directory service
is the right approach.
However, I think the security model change has been inadequately
explored in this draft as evidenced in the text and in responses I
received.
So I continue to believe that last-call is premature until the security
model changes are adequately explored and then documented.