Subject: [websec] Issue that came up about HSTS

From: Yoav Nir <[email-masked]>
Date: Sat, 27 Oct 2012 08:42:47 +0200

Hi all

draft-ietf-websec-strict-transport-sec is now being edited by the RFC editor. An issue has come up. We need to resolve this quickly, so please read the following and reply to the list with your opinions.

Section 8.4 begins as follows:

8.4. Errors in Secure Transport Establishment

  When connecting to a Known HSTS Host, the UA MUST terminate the
  connection (see also Section 12 "User Agent Implementation Advice")
  if there are any errors, whether "warning" or "fatal" or any other
  error level, with the underlying secure transport.  For example, this
  includes any errors found in certificate validity checking UAs employ
  such as via Certificate Revocation Lists (CRL) [RFC5280], or via the
  Online Certificate Status Protocol (OCSP) [RFC2560].

The list of example ways that the UA employs to validate certificates includes CRLs and OCSP. The authors believe that the list should be extended to also include a reference to the succinctly-named RFC 6125 ("Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)"). See the below suggested text, the new stuff begins with "as well as" on the penultimate line.

8.4. Errors in Secure Transport Establishment

  When connecting to a Known HSTS Host, the UA MUST terminate the
  connection (see also Section 12 "User Agent Implementation Advice")
  if there are any errors, whether "warning" or "fatal" or any other
  error level, with the underlying secure transport.  For example, this
  includes any errors found in certificate validity checking UAs employ
  such as via Certificate Revocation Lists (CRL) [RFC5280], or via the
  Online Certificate Status Protocol (OCSP) [RFC2560], as well as via
  server identity checking [RFC6125]. 

Note that this is not an additional Last Call. If nobody strongly objects to this addition, we will add it. We have already heard from Barry that this addition is fine, and will not require a new LC.

Please respond soon, as the RFC editor is working on this document now.

Thanks

Yoav

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 27 Oct 2012 08:55:20 -0700

> draft-ietf-websec-strict-transport-sec is now being edited by the RFC editor. An issue has come up. We need to resolve this quickly, so please read the following and reply to the list with your opi…

This looks like a useful, harmless addition.

--Paul Hoffman

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Mon, 29 Oct 2012 02:53:23 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Paul Hoffman
> 
> > draft-ietf-websec-strict-transport-sec is now being edited by the RFC
> editor. An issue has come up. We need to resolve this quickly, so please read
> the following and reply to the list with your opinions.
> 

If you need a second, consider this it :)

- Andy

---

From: Yoav Nir <[email-masked]>
Date: Mon, 29 Oct 2012 08:02:31 +0200

> If you need a second, consider this it :)

That's good to know.

What we're really after is the presence of (or lack of) statements such as "oh my god, this is a horrible idea", preferably followed by something beginning with "because" :)

Otherwise, the authors are for this change (it was Jeff's idea) and if nobody objects, it will go in.

Yoav