Subject: [dane] List of resources?

From: Jack Bates <[email-masked]>
Date: Sat, 13 Jul 2013 11:14:24 -0700

Hello,

I've been searching for tools that implement DANE and instructions for 
generating TLSA records and I wonder if somethere there is a list of 
DANE resources? In particular, does there exist a website that will 
verify TLSA records, similar to:

    http://dnssec-debugger.verisignlabs.com/

Here is the list of resources that my searching turned up:

Specs:

    o  RFC 6698: http://tools.ietf.org/html/rfc6698
    o  Specs covering specific applications of DANE: 
http://tools.ietf.org/wg/dane/

Demo sites (sites that implement server side of DANE):

    o  http://www.internetsociety.org/deploy360/resources/dane-test-sites/

Tools:

    o  SWEDE: https://github.com/pieterlexis/swede
    o  hash-slinger: http://people.redhat.com/pwouters/hash-slinger/
    o  tlsa_rdata: https://github.com/shuque/tlsa_rdata
    o  DANE Patrol: https://labs.nic.cz/page/1207/dane-patrol/
    o  Extended DNSSEC Validator: https://os3sec.org/
    o  DNSSEC/TLSA Validator: http://people.redhat.com/pwouters/

Talks:

    o  Linux Security Summit 2012: 
http://people.redhat.com/pwouters/LinuxCon2012-DNSSEC.pdf

Resources:

    o  Walking Through Setting Up A TLSA Record for DNSSEC/DANE: 
http://blog.huque.com/2012/10/dnssec-and-certificates.html
    o  The DANE Protocol: 
http://www.internetsociety.org/deploy360/resources/dane/
    o  Posts tagged "DANE": 
http://www.internetsociety.org/deploy360/blog/tag/dane/
    o  IETF Journal October 2011: 
http://www.internetsociety.org/articles/dane-taking-tls-authentication-next-level-using-dnssec
    o  Mozilla: https://wiki.mozilla.org/Security/DNSSEC-TLS-details
    o  Postfix: http://www.postfix.org/TLS_README.html
    o  Wikipedia: 
http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

Notes:

    o  RFC 6698 section 8 Security Considerations: When it says "A rogue 
DNS administrator ...  That administrator could probably get a 
certificate issued by some CA anyway, so this is not an additional 
threat." it means that under DANE a person who controls the DNS controls 
the TLS security (because they can change the certificate) but in 
reality this is already the case because many CAs use control of MX 
record to establish ownership of a domain and issue a valid certificate.

---

From: Dan York <[email-masked]>
Date: Mon, 15 Jul 2013 09:42:13 +0200

Jack,

On Sat, Jul 13, 2013 at 8:14 PM, Jack Bates <[email-masked]> wrote:

> generating TLSA records and I wonder if somethere there is a list of DANE
> resources?

That is exactly what I have been aiming to do with a page that you mention
later in your list of resources:

http://www.internetsociety.**org/deploy360/resources/dane/<http://www.internetsociety.org/deploy360/resources/dane/>

Having said that, I haven't updated the page in a bit and obviously need to
do so in light of some of the additional tools you pointed out in your
search results.  I will do so shortly, as I am giving a brief DANE tutorial
at ICANN 47 during the DNSSEC Workshop on this coming Wednesday, July 17.

I would welcome any suggestions for more items to add to that page.  My
point of doing so is to help enable more people to get out there deploying
DANE.

> In particular, does there exist a website that will verify TLSA records,
> similar to:
>

I am not away of any sites that verify TLSA records yet.

Regards,
Dan

--
Dan York, [email-masked]
http://danyork.me   http://twitter.com/danyork

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Mon, 15 Jul 2013 10:09:58 +0200

Hi,

On 07/15/13 09:42, Dan York wrote:

>>     In particular, does there exist a website that will verify TLSA
>>     records, similar to:

<missed that part>

> I am not away of any sites that verify TLSA records yet.

Are you familiar with:

http://check.sidnlabs.nl/dane/ ?

Also, the example-utilities of 'LDNS' contains a good tool to generate
TLSA records. In fact, the web-page above is based on that tool (ldns-dane).

http://www.nlnetlabs.nl/projects/ldns/

Regards,

--
Marco

---

From: Paul Wouters <[email-masked]>
Date: Mon, 15 Jul 2013 14:47:46 -0400 (EDT)

On Mon, 15 Jul 2013, Dan York wrote:

> I would welcome any suggestions for more items to add to that page.  My point of doing so is to help enable more people to get out
> there deploying DANE.
>  
>       In particular, does there exist a website that will verify TLSA records, similar to:
> 

You can check https://nohats.ca/ versus https://rogue.nohats.ca/

The latter one has an invalid TLSA record:

_443._tcp.rogue.nohats.ca. 3446	IN	TLSA	3 1 0 00000000000000000000000000000000000000000000000000000000 00000000

I'll see if I can throw up a website that uses hash-slinger to check
TLSA records of other sites (after today's 24:00 UTC cut-off :)

Paul

---

From: Paul Wouters <[email-masked]>
Date: Mon, 15 Jul 2013 14:49:57 -0400 (EDT)

> http://check.sidnlabs.nl/dane/ ?

Oh, I was not :)

Is there a way to deeplink, eg like: http://check.sidnlabs.nl/dane/?q=rogue.nohats.ca

Paul

---

From: Dan York <[email-masked]>
Date: Mon, 15 Jul 2013 23:55:48 +0200

Marco,

> http://check.sidnlabs.nl/dane/ ?

Now that you mention it, I do seem to remember hearing about that... but I
had forgotten in the interim.  Thanks for sending along the link. I'll add
it to the list of resources.

Thanks,
Dan

---

From: Jack Bates <[email-masked]>
Date: Tue, 16 Jul 2013 11:26:44 -0700

> Is there a way to deeplink, eg like: http://check.sidnlabs.nl/dane/?q=rogue.nohats.ca

Great, the debugging messages from this website are helpful, thank you Marco.

I think it could also be a useful resource for getting more details about a
TLSA setup, if for example it also displayed the certificate usage, etc.

Thanks!