[147245] in cryptography@c2.net mail archive
Re: [Cryptography] PRISM-Proofing and PRISM-Hardening
daemon@ATHENA.MIT.EDU (Ben Laurie)
Thu Sep 19 16:31:09 2013
X-Original-To: cryptography@metzdowd.com
In-Reply-To: <20130918204717.GY29796@mournblade.imrryr.org>
Date: Thu, 19 Sep 2013 21:15:58 +0100
From: Ben Laurie <ben@links.org>
To: Cryptography Mailing List <cryptography@metzdowd.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
--===============4266904415459190851==
Content-Type: multipart/alternative; boundary=001a11c3127ed1edd504e6c2382c
--001a11c3127ed1edd504e6c2382c
Content-Type: text/plain; charset=ISO-8859-1
On 18 September 2013 21:47, Viktor Dukhovni <cryptography@dukhovni.org>wrote:
> On Wed, Sep 18, 2013 at 08:04:04PM +0100, Ben Laurie wrote:
>
> > > This is only realistic with DANE TLSA (certificate usage 2 or 3),
> > > and thus will start to be realistic for SMTP next year (provided
> > > DNSSEC gets off the ground) with the release of Postfix 2.11, and
> > > with luck also a DANE-capable Exim release.
> >
> > What's wrong with name-constrained intermediates?
>
> X.509 name constraints (critical extensions in general) typically
> don't work.
>
No. They typically work. As usual, Apple are the fly in the ointment.
--001a11c3127ed1edd504e6c2382c
Content-Type: text/html; charset=ISO-8859-1
<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On 18 September 2013 21:47, Viktor Dukhovni <span dir="ltr"><<a href="mailto:cryptography@dukhovni.org" target="_blank">cryptography@dukhovni.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On Wed, Sep 18, 2013 at 08:04:04PM +0100, Ben Laurie wrote:<br>
<br>
> > This is only realistic with DANE TLSA (certificate usage 2 or 3),<br>
> > and thus will start to be realistic for SMTP next year (provided<br>
> > DNSSEC gets off the ground) with the release of Postfix 2.11, and<br>
> > with luck also a DANE-capable Exim release.<br>
><br>
> What's wrong with name-constrained intermediates?<br>
<br>
</div>X.509 name constraints (critical extensions in general) typically<br>
don't work.<br></blockquote><div><br></div><div>No. They typically work. As usual, Apple are the fly in the ointment.</div><div><br></div></div></div></div>
--001a11c3127ed1edd504e6c2382c--
--===============4266904415459190851==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
--===============4266904415459190851==--
