Subject: Re: [dane] Anyone interested in writing a DANE tutorial?

From: Sandoche Balakrichenan <[email-masked]>
Date: Mon, 15 Apr 2013 15:08:57 +0200

Hi Dan and all,

       Even though it took some time, here in i attach a tutorial style
document which explains implementing DANE and a Proof of Concept using a
browser add-on.

In case, if the attached document is interesting, i am ready to maintain
it with new add-ons developed for DANE.

Thanks for your views and feedback.

Regards,
Sandoche BALAKRICHENAN

On 09/26/2012 08:27 PM, Dan York wrote:
> On Tue, 25 Sep 2012, Warren Kumari wrote:
>
>> Something that would be very helpful for getting this deployed /
>> implemented in browsers is number of folk (and more importantly,
>> organizations) stating that they are planning on / would do DANE if
>> the browsers supported it natively. Of course, even more helpful would
>> be folk actually publishing TLSA records :-P
>
> To this last point about getting more TLSA records published, would
> anyone be interested in writing a step-by-step tutorial for how to
> publish a TLSA record?  Or collaborating on writing one?
>
> If we had a page that was a simple set of steps it would be something
>  we could pass around and encourage people to consider doing.  I'm
> thinking of something like:
>
> Existing certificate:
>  - get a copy of your TLS certificate
>  - generate the appropriate hash using ____
>  - create a DNS record that looks like "........."
>  - publish record (including DNSSEC signing) and celebrate
>
> New certificate
>   - generate a new TLS certificate using ____
>   - install certificate in your web server (perhaps assume Apache for
> the tutorial)
>   - generate the appropriate hash using ____
>  - create a DNS record that looks like "........."
>  - publish record (including DNSSEC signing) and celebrate
>
> Now those steps may not be complete... this is just a first thought...
> and given that I've never deployed a TLSA record (but would like to) I
> don't know the exact steps. 
>
> If anyone would be interested in creating something like this, I'd be
> glad to publish it on our Deploy360 site (with attribution to you and
> a link to a site) or if you publish it on your site I'd be glad to
> link to it from Deploy360.    Or if you'd like to collaborate with me
> on writing something, I'd be glad to help with it.
>
> Even if someone could sketch out the basic outline of the commands one
> would use for the steps above, I'd be glad to write some text
> narrative explaining the commands.
>
> Anyone interested?
>
> Thanks,
> Dan
>
>
> -- 
> Dan York  [email-masked] <mailto:[email-masked]>
> http://www.danyork.me/ <http://www.danyork.com/>   skype:danyork
> Phone: +1-802-735-1624
> Twitter - http://twitter.com/danyork
>
>
>
>
>
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Christian Heutger <[email-masked]>
Date: Mon, 15 Apr 2013 14:04:22 +0000

Hi,

I'm new to this, but doesn't DANE improve the CA trust model instead of replacing it? If the certificate itself is placed in the DNS signed, the IP can't be spoofed, also the certificate can't be spoofed, but the advantages of a third party validating the details of the certificate requester still exist?! In addition, we have a two level trust point: the DNSSEC and the certificate issued by a third party. Meanwhile the DNSSEC signing key can be stolen, as there would be less security than at a WebTrust audited certificate authority, it then also still requires in addition to successfully attack a certificate authority or vice versa, if successfully attacking a certificate authority the DNSSEC also need to be hacked. Just using DANE will result, that it's enough to hack the DNSSEC key and as we got known of recent attacks on companies, that seems to occur more often than successfully attacking a certificate authority. The only successful attack was against DigiNotar, who reacted as the worst in the scene ever. Comodo was "just" a lack of validation through their registry authority scheme, which has been immediately shut down in its recent manner, Trustwaves Sub CA program, which also has been closed down to prevent from such future occurrence. So also the revoke scheme is much easier, as the OCSP and CRL are well established and usually asked for each encrypted site access, by just publishing new DNSSEC records it depends on the caching settings of the DNSSEC resolvers to get aware of a new public key.

Regards,
Christian

Von: Sandoche Balakrichenan <[email-masked]<mailto:[email-masked]>>
Datum: Montag, 15. April 2013 15:08
An: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: Niall O'Reilly <[email-masked]<mailto:[email-masked]>>, Phil Regnauld <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Betreff: Re: [dane] Anyone interested in writing a DANE tutorial?

Hi Dan and all,

       Even though it took some time, here in i attach a tutorial style document which explains implementing DANE and a Proof of Concept using a browser add-on.

In case, if the attached document is interesting, i am ready to maintain it with new add-ons developed for DANE.

Regards,
Sandoche BALAKRICHENAN

To this last point about getting more TLSA records published, would anyone be interested in writing a step-by-step tutorial for how to publish a TLSA record?  Or collaborating on writing one?

If we had a page that was a simple set of steps it would be something  we could pass around and encourage people to consider doing.  I'm thinking of something like:

Existing certificate:

New certificate
  - install certificate in your web server (perhaps assume Apache for the tutorial)

Now those steps may not be complete... this is just a first thought... and given that I've never deployed a TLSA record (but would like to) I don't know the exact steps.

If anyone would be interested in creating something like this, I'd be glad to publish it on our Deploy360 site (with attribution to you and a link to a site) or if you publish it on your site I'd be glad to link to it from Deploy360.    Or if you'd like to collaborate with me on writing something, I'd be glad to help with it.

Even if someone could sketch out the basic outline of the commands one would use for the steps above, I'd be glad to write some text narrative explaining the commands.

Anyone interested?

Thanks,
Dan

--
Dan York  [email-masked]<mailto:[email-masked]>
http://www.danyork.me/<http://www.danyork.com/>   skype:danyork
Phone: +1-802-735-1624
Twitter - http://twitter.com/danyork

_______________________________________________
dane mailing list
[email-masked]<mailto:[email-masked]>https://www.ietf.org/mailman/listinfo/dane

--
This message was scanned by ESVA and is believed to be clean.

---

From: Phil Regnauld <[email-masked]>
Date: Mon, 15 Apr 2013 18:42:47 +0200

Christian Heutger (ch) writes:
> Hi,
> 
> I'm new to this, but doesn't DANE improve the CA trust model instead
> of replacing it?

	It can do both, that is up to the owner of the zone to decide.

	Cheers,
	Phil

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 15 Apr 2013 18:30:25 +0000

> document which explains implementing DANE and a Proof of Concept using a

The "guide" could be much shorter.  Just explain clearly how to set up
TLSA records for HTTPS in the context of an already signed DNSSEC zone.

The description of DNSSEC configuration is too miminal to be very
useful. In fact almost downright dangerous, since operating a DNSSEC
zone is a lot more involved than a one-time registration of a DS
RR in the parent zone.  This topic is covered in a lot more depth
elsewhere and you're unlikely to do it justice except by reference
to something that already covers this well.

Since the write-up explains none of the implementation details of
the browser client plugin, the discussion of the client behaviour
is just a distraction.

Is the document a paper for academic publication or a How-To guide
for system administrators?  It seems to be a strange mixture of
the two.

-- 
	Viktor.

---

From: Christian Heutger <[email-masked]>
Date: Mon, 15 Apr 2013 18:29:21 +0000

Hi,

if the owner decides and it shows up in the browsers and systems the same, the security is still more weaker than in a combination, so that seems not to be a good solution.

Regards,
Christian

Hi Dan and all,

Regards,
Sandoche BALAKRICHENAN

Existing certificate:

New certificate

Anyone interested?

Thanks,
Dan

---

From: Sandoche Balakrichenan <[email-masked]>
Date: Tue, 16 Apr 2013 08:13:03 +0200

> 	It can do both, that is up to the owner of the zone to decide.
+1 : The document clearly specifies that DANE does reinforce the CA
trust model.

---

From: Sandoche Balakrichenan <[email-masked]>
Date: Tue, 16 Apr 2013 08:21:18 +0200

Thank for your feedback. My comments below:

> TLSA records for HTTPS in the context of an already signed DNSSEC zone.
==> The focus of the document was to act as a guide for someone who has
a domain name and has some knowledge (an expert does not need this
document) of configuring his domain zone to add a TLSA RR and do an
end-to-end test. Making it more shorter, i felt will not fulfill this
objective.
> to something that already covers this well.
==> Completely agree. Will provide a proper reference in the next iteration.
> the browser client plugin, the discussion of the client behaviour
==> My first comment answers this question.
> for system administrators?  It seems to be a strange mixture of
==> More as an How-To guide?

Thanks again,
Sandoche.

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 16 Apr 2013 13:29:14 +0000

> ==> More as an How-To guide?

And yet it is written in the style of an academic paper.

If it is a How-To, it needs to be HTML not PDF, with links at the
top to each section and links to references in-line, not in a
references section at the end.  A How-To guide is rarely read in
full.

Since this How-To guide is not for implementors of client-side
browser implementations, it does not need to discuss the features
or tests of such a client.

The not generally pre-installed SWEDE tool is not needed to compute
the certificate and public-key digests, for example with OpenSSL:

  # Certificate digest with with OpenSSL:
  $ openssl x509 -in /tmp/cert.pem -outform DER |
      openssl dgst -sha256 |
      awk -v L=www.example.com '{printf "%s. IN TLSA 3 0 1 %s\n", L, $NF}'

  # Public key digest with OpenSSL 1.0.x with all certificate types.
  $ openssl x509 -in cert.pem -noout -pubkey |
      openssl pkey -pubin -outform DER |
      openssl dgst -sha256 |
      awk -v L=www.example.com '{printf "%s. IN TLSA 3 1 1 %s\n", L, $NF}'

  # Public key digest with OpenSSL 0.9.8 with RSA certificates.
  $ openssl x509 -in cert.pem -noout -pubkey |
      openssl rsa -pubin -outform DER |
      openssl dgst -sha256 |
      awk -v L=www.example.com '{printf "%s. IN TLSA 3 1 1 %s\n", L, $NF}'

The guide needs to be more concise with sections clearly focused on the
limited attention of a How-To reader.

-- 
	Viktor.

---

From: Richard Barnes <[email-masked]>
Date: Tue, 16 Apr 2013 11:26:01 -0400

In a related vein, I gave a DANE overview at a NIST workshop last week:
<
http://csrc.nist.gov/groups/ST/ca-workshop-2013/presentations/Barnes_ca-workshop2013.pdf

On Mon, Apr 15, 2013 at 9:08 AM, Sandoche Balakrichenan <
[email-masked]> wrote:

> anyone be interested in writing a step-by-step tutorial for how to publish
> a TLSA record?  Or collaborating on writing one?
>
>  we could pass around and encourage people to consider doing.  I'm thinking
> of something like:
>
>  Existing certificate:
> glad to publish it on our Deploy360 site (with attribution to you and a
> link to a site) or if you publish it on your site I'd be glad to link to it
> from Deploy360.    Or if you'd like to collaborate with me on writing
> something, I'd be glad to help with it.
>
> would use for the steps above, I'd be glad to write some text narrative
> explaining the commands.
>
>  Anyone interested?
>
>  Thanks,
> Dan
>
>
>    --
> Dan York  [email-masked]
> dane mailing [email-masked]://www.ietf.org/mailman/listinfo/dane
>
>
>