Subject: Re: [secdir] weirds and certificate naming

From: Sean Turner <[email-masked]>
Date: Wed, 14 Aug 2013 19:51:22 -0400

Sam,

It looks like their MTI mechanism is:

  To that end, RDAP clients and
  servers MUST implement the authentication framework specified in
  "HTTP Authentication: Basic and Digest Access Authentication"
  [RFC2617].

spt

On 7/29/13 9:31 AM, Sam Hartman wrote:
>
>
> Hi.
> To the ADs and especially to the folks who have outstanding weirds
> reviews.
>
> Please chase down how a query name entered by a user makes its way into
> a URI and how weirds validates the certificate in that URI.
> I suspect that there are problems here.
> For example, I suspect insecure DNS queries may be used to find parts of
> that URI.
> Alternatively  even if DNSsec is available, I suspect supporting DNSsec
> may not be a MTI for weirds clients.
> So, I'm dubious whether weirds will have an interoperable MTI security
> mechanism.
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>

---

From: Sam Hartman <[email-masked]>
Date: Wed, 14 Aug 2013 20:04:58 -0400

>>>>> "Sean" == Sean Turner <[email-masked]> writes:

    Sean> Sam, It looks like their MTI mechanism is:

    Sean>  To that end, RDAP clients and servers MUST implement the
    Sean> authentication framework specified in "HTTP Authentication:
    Sean> Basic and Digest Access Authentication" [RFC2617].

I don't understand how that helps authenticate the server at all.
This seems horribly broken.

Strongly recommend convincing yourself that the query string typed by
the user is securily mapped to the identity of the right server.