Re: [TLS] raw public keys in the wild?

[Viktor Dukhovni]

> On Aug 23, 2018, at 5:07 PM, Richard Barnes <r...@ipv.sx> wrote:
> 
> Since we're talking about bare public keys / not verifying certificates 
> again, a brief reminder:
> 
> https://tools.ietf.org/html/draft-barnes-dane-uks-00

Yes, what do you want to do with that draft?  The conclusions for
HTTPS are correct.  For SMTP, UKS surely does not apply, one can
already direct one's SMTP traffic to a different server by just
pointing MX records there...  Ditto for protocols that use SRV
indirection.

So I'd support moving that forward, but perhaps with a more
nuanced set of conditions on when host name checks must not
be skipped.

-- 
        Viktor.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls