Subject: [dane] OpenSSL 1.1.0 released, supports DANE TLSA

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 26 Aug 2016 16:25:32 +0000

For those who might not yet have heard the news, OpenSSL 1.1.0 was
released yesterday and includes support for DANE TLSA authentication.

    https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_dane_enable.html
    https://www.openssl.org/docs/manmaster/apps/s_client.html

Example:

   $ PATH=/.../OpenSSL_1_1_0/bin:$PATH
   $  dig +short -t mx ietf.org |
         while read pref mx; do
            mx=${mx%.}
            printf "=== %s\n" "$mx"
            dig +short -t tlsa "_25._tcp.$mx" |
               while read rrdata; do
                  printf "+++ %s\n" "$rrdata"
                  (sleep 2; printf "QUIT\r\n" ) |
                  openssl s_client -brief -starttls smtp -connect "$mx:25" \
                     -dane_tlsa_domain "$mx" -dane_tlsa_rrdata "$rrdata" \
                     -dane_ee_no_namechecks
               done
         done
   === mail.ietf.org
   +++ 3 1 1 0C72AC70B745AC19998811B131D662C9AC69DBDBE7CB23E5B514B566 64C5D3D6
   CONNECTION ESTABLISHED
   Protocol version: TLSv1.2
   Ciphersuite: ECDHE-RSA-AES256-GCM-SHA384
   Peer certificate: OU = Domain Control Validated, CN = *.ietf.org
   Hash used: SHA512
   Verification: OK
   Verified peername: *.ietf.org
   DANE TLSA 3 1 1 ...e7cb23e5b514b56664c5d3d6 matched EE certificate at depth 0
   Supported Elliptic Curve Point Formats: uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2
   Server Temp Key: ECDH, P-256, 256 bits
   250 8BITMIME
   DONE

-- 
	Viktor.

---

From: "Garfinkel, Simson L. (Fed)" <[email-masked]>
Date: Fri, 26 Aug 2016 17:26:10 +0000

Viktor,

It’s great that this is out.

Question — was there any usability testing done regarding the API?

Simson

On 8/26/16, 12:25 PM, "dane on behalf of Viktor Dukhovni" <[email-masked] on behalf of [email-masked]> wrote:

    
    Example:

    -- 
    	Viktor.
    
    _______________________________________________
    dane mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/dane

---

From: "Rene \"Renne\" Bartsch ([email-masked])" <[email-masked]>
Date: Sat, 27 Aug 2016 12:51:03 +0000

We should do some lobbying with browser vendors to get attention from the masses. It will help DANE if requested by users. ;-)

What TLS-libraries do other browsers use? What other TLS-libraries other than OpenSSL do support DANE-TLS?

Mozilla Firefox -> NSS
Google Chrome/Chromium -> BoringSSL

26. August 2016 18:25, "Viktor Dukhovni" <[email-masked]> schrieb:
> Supported Elliptic Curve Point Formats:
> uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 27 Aug 2016 13:31:56 -0400

> On Aug 27, 2016, at 8:51 AM, Rene Renne Bartsch ([email-masked]) <[email-masked]> wrote:
> 

Browsers are I think unlikely to support DANE quite yet. They
probably need DNSSEC stapling standardized and implemented in
HTTP servers (nginx, Apache, IIS, ...) before enabling DANE
support in browsers is worth the effort.

Browsers all too often find themselves in environments that
are hostile to client DNSSEC access, so DANE without stapling
is I think not an option for browsers now or for many years
forward.

-- 
	Viktor.