Subject: [dane] Anyone interested in writing a DANE tutorial?

From: Dan York <[email-masked]>
Date: Wed, 26 Sep 2012 14:27:26 -0400

On Tue, 25 Sep 2012, Warren Kumari wrote:

> Something that would be very helpful for getting this deployed /
> implemented in browsers is number of folk (and more importantly,
> organizations) stating that they are planning on / would do DANE if
> the browsers supported it natively. Of course, even more helpful would
> be folk actually publishing TLSA records :-P

To this last point about getting more TLSA records published, would anyone be interested in writing a step-by-step tutorial for how to publish a TLSA record?  Or collaborating on writing one?

If we had a page that was a simple set of steps it would be something  we could pass around and encourage people to consider doing.  I'm thinking of something like:

Existing certificate:
 - get a copy of your TLS certificate
 - generate the appropriate hash using ____
 - create a DNS record that looks like "........."
 - publish record (including DNSSEC signing) and celebrate

New certificate
  - generate a new TLS certificate using ____
  - install certificate in your web server (perhaps assume Apache for the tutorial)
  - generate the appropriate hash using ____
 - create a DNS record that looks like "........."
 - publish record (including DNSSEC signing) and celebrate

Now those steps may not be complete... this is just a first thought... and given that I've never deployed a TLSA record (but would like to) I don't know the exact steps. 

If anyone would be interested in creating something like this, I'd be glad to publish it on our Deploy360 site (with attribution to you and a link to a site) or if you publish it on your site I'd be glad to link to it from Deploy360.    Or if you'd like to collaborate with me on writing something, I'd be glad to help with it.

Even if someone could sketch out the basic outline of the commands one would use for the steps above, I'd be glad to write some text narrative explaining the commands.

Anyone interested?

Thanks,
Dan

-- 
Dan York  [email-masked]
http://www.danyork.me/   skype:danyork
Phone: +1-802-735-1624
Twitter - http://twitter.com/danyork

---

From: Pieter Lexis <[email-masked]>
Date: Wed, 26 Sep 2012 23:12:02 +0200

Hi Dan,

On 09/26/2012 08:27 PM, Dan York wrote:
> If we had a page that was a simple set of steps it would be something
>  we could pass around and encourage people to consider doing.  I'm
> thinking of something like:
> 
> Existing certificate:
> Now those steps may not be complete... this is just a first thought...
> and given that I've never deployed a TLSA record (but would like to) I
> don't know the exact steps. 

Looks good to me. Appendix A.4 of RFC 6698[0] describes the way to do it
(it is similar to DNSSEC key-rollover). I would recommend reading
Appendix A in full to understand the implication of certain choices of
matching type and selector.

As for tooling, I wrote a (proof of concept) tool called 'swede'[2] in
January of this year (and updated it when needed). It has been used to
create the Examples (Appendix C) in RFC 6698. The code is a bit messy,
but it works. I'm currently re-implementing it in a more maintainable
fashion (hopefully finished within a few weeks, but you never know).

> Even if someone could sketch out the basic outline of the commands one
> would use for the steps above, I'd be glad to write some text narrative
> explaining the commands.

I'd say try: swede and ask me or the mailing list for feedback when you
publish your articles.

Cheers,

Pieter

1 - http://tools.ietf.org/html/rfc6698#appendix-A.4
2 - https://github.com/pieterlexis/swede

---

From: Paul Wouters <[email-masked]>
Date: Wed, 26 Sep 2012 18:15:10 -0400 (EDT)

On Wed, 26 Sep 2012, Dan York wrote:

> To this last point about getting more TLSA records published, would anyone be interested in writing a step-by-step tutorial for how
> to publish a TLSA record?  Or collaborating on writing one?

My slidedeck from Linux Security Summit 2012 had that information.
I'll also be presenting about this at SecTor and ICANN.

> text narrative explaining the commands.

yum | apt-get install hash-slinger (from http://people.redhat.com/pwouters/hash-slinger )

[paul@bofh]$ tlsa --create ietf.org
No certificate specified on the commandline, attempting to retrieve it from the server ietf.org.
Attempting to get certificate from 64.170.98.30
Got a certificate with Subject: /O=*.ietf.org/OU=Domain Control Validated/CN=*.ietf.org
_443._tcp.ietf.org. IN TLSA 3 0 1 54f3fd877632a41c65b0ff4e50e254dd7d1873486231dc6cd5e9c1c1963d1e4e

Or use -o generic, to get the record in generic format for those
nameserves or signers that do not yet support the TLSA RRtype:

[paul@bofh]$ tlsa --create -o generic ietf.org
No certificate specified on the commandline, attempting to retrieve it from the server ietf.org.
Attempting to get certificate from 64.170.98.30
Got a certificate with Subject: /O=*.ietf.org/OU=Domain Control Validated/CN=*.ietf.org
_443._tcp.ietf.org. IN TYPE52 \# 35 03000154f3fd877632a41c65b0ff4e50e254dd7d1873486231dc6cd5e9c1c1963d1e4e

Paul

---

From: Dan York <[email-masked]>
Date: Fri, 28 Sep 2012 12:43:41 -0400

Pieter,

> matching type and selector.

Appendix A is great... but I'm looking to create something that is *extremely*
simple and easy.  I think it really needs to be tool-based so that people just
have to run some scripts.

> 2 - https://github.com/pieterlexis/swede

and will check out the code and try it out.  I also noticed recently that you added TLSA support into dnspython although it wasn't immediately clear to me how to use that support. (dnspython could use some examples related to dnssec in general... at some point I may go and write some if no else does that first.)

Thanks for the suggestions and the link to swede.

Dan

---

From: Paul Wouters <[email-masked]>
Date: Fri, 28 Sep 2012 13:55:23 -0400 (EDT)

On Fri, 28 Sep 2012, Dan York wrote:

> and will check out the code and try it out.  I also noticed recently that you added TLSA support into dnspython although it wasn't
> immediately clear to me how to use that support. (dnspython could use some examples related to dnssec in general... at some point I may
> go and write some if no else does that first.)

documentation there is indeed lacking,

[paul@bofh ~]$ python
Python 2.7.3 (default, Jul 24 2012, 10:05:38) 
[GCC 4.7.0 20120507 (Red Hat 4.7.0-5)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import dns.resolver
>>> answers = dns.resolver.query('_443.import dns.resolver', 'TLSA')
>>> answers
<dns.resolver.Answer object at 0x2259350>
>>> for rdata in answers:
...     print rdata
... 
1 0 1 6bcff9a283336dd1ed99a9c40427741b5658863bd54f0a876a2bc4bf8d822112
>>> answers[0].selector
0
>>> answers[0].usage
1

Hope this helps,

Note that Pieter's TLSA patch in dnspython has been pushed into Fedora/RHEL a
few days ago. It's available in updates-testing and should be available
as a released update in a week or so.

Paul

---

From: Dan York <[email-masked]>
Date: Fri, 28 Sep 2012 14:19:55 -0400

Paul,

> I'll also be presenting about this at SecTor and ICANN.

Nice presentation!   For others interested the link is at http://kernsec.org/files/LinuxCon2012-DNSSEC.pdf

There certainly are pieces in there that can be pulled out for a tutorial.

> yum | apt-get install hash-slinger (from http://people.redhat.com/pwouters/hash-slinger )

Looks like a very nice tool.  Before I go trying to see if I can get it to work on Mac OS X, are you aware of anyone else doing so?   (I have an interest in demo-ing a tool like this at conferences and events - and my laptop is a Mac.)

Thanks for the info and link,
Dan

---

From: Dan York <[email-masked]>
Date: Fri, 28 Sep 2012 15:06:28 -0400

Paul

On Sep 28, 2012, at 1:55 PM, Paul Wouters wrote:

> [paul@bofh ~]$ python
> Python 2.7.3 (default, Jul 24 2012, 10:05:38) [GCC 4.7.0 20120507 (Red Hat 4.7.0-5)] on linux2

Excellent!  Worked beautifully with:

   import dns.resolver
   answers= dns.resolver.query('_443._tcp.www.torproject.org','TLSA')
   for rdata in answers:
       print rdata

I can see the TLSA record. 

So now I have the record... assuming I used dnspython as part of a larger application I would now be able to compare the record to the TLS certificate I get from a website.  Any code in here to help with the comparison?  Or is that something I would need to do in my code?  (i.e. write a function to do a hash on the TLS certificate and compare that to the TLSA record)

> Hope this helps,

It does.

> as a released update in a week or so.

Great!

Thanks,
Dan