Subject: Re: [certid] What security does SRV-ID add when DNS-ID will always match?

From: =JeffH <[email-masked]>
Date: Mon, 17 Jan 2011 11:57:50 -0800

> The use of SRV-IDs is supposed to ensure that the client connects to the
 > service type it wanted from among the services available at the DNS name
 > it wanted.  However, given that...
 >
 > - The client's list of reference identifiers MUST include a DNS-ID
 > (section 6.2.10)

you mean S6.2.1, yes?

 > - The examples of server certificates that include a SRV-ID (section
 > 4.2) also include a DNS-ID
 > - The server ID check succeeds if any reference identifier matches any
 > presented identifier (section 6.3)
 >
 > it would appear that the DNS-IDs will always match, making the service
 > types in the SRV-IDs irrelevant.  Am I right?

thx for the headsup, but I don't think so, see section 6.5...

###

6.5. Matching the Application Type Portion

    If a client supports checking of identifiers of type SRV-ID and
    URI-ID, it MUST also check the service type of the application
    service with which it communicates (in addition to checking the
    domain name as described above).  This is a best practice because
    typically a client is not designed to communicate with all kinds of
    services using all possible application protocols, but instead is
    designed to communicate with one kind of service, such as websites,
    email services, VoIP services, or IM services.

    The service type is verified by means of an SRV-ID or a URI-ID.

6.5.1. SRV-ID

    The service name portion of an SRV-ID (e.g., "imaps") MUST be matched
    in a case-insensitive manner, in accordance with [DNS-SRV].  Note
    that the "_" character is prepended to the service identifier in DNS
    SRV records and in SRV-IDs (per [SRVNAME]), and thus does not need to
    be included in any comparison.

6.5.2. URI-ID

    The scheme name portion of a URI-ID (e.g., "sip") MUST be matched in
    a case-insensitive manner, in accordance with [URI].  Note that the
    ":" character is a separator between the scheme name and the rest of
    the URI, and thus does not need to be included in any comparison.

###

I note that we should fix the S6.5 title to be..

   "Matching the Application Service Type Portion"

..or simply..

   "Matching the Application Service Type"

thanks,

=JeffH

---

From: Matt McCutchen <[email-masked]>
Date: Mon, 17 Jan 2011 15:55:19 -0500

>  > - The client's list of reference identifiers MUST include a DNS-ID

Yes (typo)

>     domain name as described above).
[...]

Maybe I am misunderstanding how that section applies.  Let's consider an
example.

Reference identifiers:
1. SRV-ID _imaps.example.net
2. DNS-ID example.net

Presented identifiers:
3. SRV-ID _xmpp-server.example.net
4. DNS-ID example.net

The client checks each reference identifier against each presented
identifier (section 6.3).

#1 and #3: The service types differ, so no match.
#1 and #4: One identifier specifies a service type and the other
doesn't.  The behavior in this case is not spelled out, but I would
assume there is no match.
#2 and #3: Ditto.
#2 and #4: Neither identifier specifies service type, and the DNS names
are the same.  Is this a match?  If so, we get the problem I originally
described.

Are you saying that a client that "supports checking of identifiers of
type SRV-ID and URI-ID" MUST NOT compare two DNS-IDs, because they do
not contain the service type information that the client is required to
check?  If so, then in the following example:

Reference identifiers:
1. SRV-ID _imaps.example.net
2. DNS-ID example.net

Presented identifiers:
4. DNS-ID example.net

we would get "no match", when it seems a match would be helpful for
backward compatibility.

-- 
Matt