Английская Википедия:DNS-based Authentication of Named Entities

Шаблон:Short description Шаблон:Security protocol DNS-based Authentication of Named Entities (DANE) is an Internet security protocol to allow X.509 digital certificates, commonly used for Transport Layer Security (TLS), to be bound to domain names using Domain Name System Security Extensions (DNSSEC).^[1]

It is proposed in Шаблон:IETF RFC as a way to authenticate TLS client and server entities without a certificate authority (CA). It is updated with operational and deployment guidance in Шаблон:IETF RFC. Application specific usage of DANE is defined in Шаблон:IETF RFC for SMTP and Шаблон:IETF RFC for using DANE with Service (SRV) records.

Rationale

TLS/SSL encryption is currently based on certificates issued by certificate authorities (CAs). Within the last few years, a number of CA providers suffered serious security breaches, allowing the issuance of certificates for well-known domains to those who don't own those domains. Trusting a large number of CAs might be a problem because any breached CA could issue a certificate for any domain name. DANE enables the administrator of a domain name to certify the keys used in that domain's TLS clients or servers by storing them in the Domain Name System (DNS). DANE needs the DNS records to be signed with DNSSEC for its security model to work.

Additionally DANE allows a domain owner to specify which CA is allowed to issue certificates for a particular resource, which solves the problem of any CA being able to issue certificates for any domain.

DANE solves similar problems as:

Certificate Transparency: Ensuring that rogue CAs cannot issue certificates without the permission of the domain holder without being detected
DNS Certification Authority Authorization: Limiting which CAs can issue certificates for a given domain

However, unlike DANE, those technologies have wide support from browsers.

Email encryption

Until recently, there has been no widely implemented standard for encrypted email transfer.^[2] Sending an email is security agnostic; there is no URI scheme to designate secure SMTP.^[3] Consequently, most email that is delivered over TLS uses only opportunistic encryption.^[4] Since DNSSEC provides authenticated denial of existence (allows a resolver to validate that a certain domain name does not exist), DANE enables an incremental transition to verified, encrypted SMTP without any other external mechanisms, as described by Шаблон:IETF RFC. A DANE record indicates that the sender must use TLS.^[3]

Additionally, Шаблон:IETF RFC exists for applying DANE to S/MIME,^[5] and Шаблон:IETF RFC standardises bindings for OpenPGP.^[6]

Support

Applications

Google Chrome does not support DANE, since Google Chrome wishes to eliminate the use of 1024-bit RSA within the browser^[7] (DNSSEC previously used a 1024-bit RSA signed root,^[8] and many zones are still signed with 1024-bit RSA, although the modern default is 256-bit ECDSA^[9]). According to Adam Langley the code was written^[10] and, although it is not in Chrome today,^[11] it remains available in add-on form.^[12]
Mozilla Firefox does not support DANE, based on the reactions in tickets on the subjects DNSSEC and DANE are currently seen by Mozilla developers as outside of the scope of Firefox,^[13]^[14] addon support is available though.^[15]
GNU Privacy Guard Allows fetching keys via OpenPGP DANE (--auto-key-locate). New option --export-options export-dane. (version 2.1.14)^[16]
Cheogram Android allows verifying via DANE and shows the status if DANE was used or not^[17]

Servers

Services

Posteo^[22]
Tutanota^[23]

Libraries

OpenSSL^[24]
GnuTLS^[25]

TLSA RR

The TLSA RR (Resource Record) for a service is located at a DNS name that specifies certificate constraints should be applied for the services at a certain TCP or UDP port. At least one of the TLSA RRs must provide a validation (path) for the certificate offered by the service at the specified address.

Not all protocols handle Common Name matching the same way. HTTP requires that the Common Name in the X.509 certificate provided by the service matches regardless of the TLSA asserting its validity. SMTP does not require the Common Name matches, if the certificate usage value is 3 (DANE-EE), but otherwise does require a Common Name match. It is important to verify if there are specific instructions for the protocol being used.

RR data fields

The RR itself has 4 fields of data, describing which level of validation the domain owner provides.

the certificate usage field
the selector field
the matching type field
the certificate association data

E.g. Шаблон:Code

Certificate usage

Certificate usage value
PKIX path validation	Target of RR
PKIX path validation	Trust anchor	End entity
Required	0	1
Not required	2	3

The first field after the TLSA text in the DNS RR, specifies how to verify the certificate.

A value of 0 is for what is commonly called CA constraint (and PKIX-TA). The certificate provided when establishing TLS must be issued by the listed root-CA or one of its intermediate CAs, with a valid certification path to a root-CA already trusted by the application doing the verification. The record may just point to an intermediate CA, in which case the certificate for this service must come via this CA, but the entire chain to a trusted root-CA must still be valid.Шаблон:Efn
A value of 1 is for what is commonly called service certificate constraint (and PKIX-EE). The certificate used must match the TLSA record, and it must also pass PKIX certification path validation to a trusted root-CA.
A value of 2 is for what is commonly called trust anchor assertion (and DANE-TA). The TLSA record matches the certificate of the root CA, or one of the intermediate CAs, of the certificate in use by the service. The certification path must be valid up to the matching certificate, but there is no need for a trusted root-CA.
A value of 3 is for what is commonly called domain issued certificate (and DANE-EE). The TLSA record matches the used certificate itself. The used certificate does not need to be signed by other parties. This is useful for self-signed certificates, but also for cases where the validator does not have a list of trusted root certificates.

Selector

When connecting to the service and a certificate is received, the selector field specifies which parts of it should be checked.

A value of 0 means to select the entire certificate for matching.
A value of 1 means to select just the public key for certificate matching. Matching the public key is often sufficient, as this is likely to be unique.

Matching type

A type of 0 means the entire information selected is present in the certificate association data.
A type of 1 means to do a SHA-256 hash of the selected data.
A type of 2 means to do a SHA-512 hash of the selected data.

Certificate association data

The actual data to be matched given the settings of the other fields. This is a long "text string" of hexadecimal data.

Examples

The TLSA record for Шаблон:URL2 specifies to check the SHA-256 hash of the public key of the certificate provided, ignoring any CA.

Шаблон:Sxhl

Their mail service has the same exact certificate and TLSA. Шаблон:Sxhl Finally, the following example, does the same as the others, but does the hash calculation over the entire certificate. Шаблон:Sxhl

Standards

Шаблон:IETF RFC Use Cases and Requirements for DNS-Based Authentication of Named Entities (DANE)
Шаблон:IETF RFC The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
Шаблон:IETF RFC Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)
Шаблон:IETF RFC The DNS-Based Authentication of Named Entities (DANE) Protocol: Updates and Operational Guidance
Шаблон:IETF RFC SMTP Security via Opportunistic DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS)
Шаблон:IETF RFC Using DNS-Based Authentication of Named Entities (DANE) TLSA Records with SRV Records
Шаблон:IETF RFC DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP
Шаблон:IETF RFC Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
Шаблон:IETF RFC Using Secure DNS to Associate Certificates with Domain Names for S/MIME
Draft: Opportunistic Encryption with DANE Semantics and IPsec: IPSECA^[26]

Notes

Шаблон:Notelist

References

Шаблон:Reflist

External links

DNSSEC is unnecessary - Against DNSSEC
For DNSSEC - A rebuttal to the points in "Against DNSSEC"
List of DANE test sites
Online tool to check mail servers for DNSSEC and DANE support
Illustrated DANE advocacy with links to howtos and tools

Шаблон:SSL/TLS

[1] Шаблон:Cite news

[2] Шаблон:Cite web

[dane-smtp-berlin-3] 3,0 ^3,1 Шаблон:Cite conference

[4] Шаблон:Cite web

[5] Шаблон:Cite IETF

[6] Шаблон:Cite IETF

[7] Шаблон:Cite web Шаблон:Self-published source

[8] Шаблон:Cite web

[9] Шаблон:Cite web

[10] Шаблон:Cite web Шаблон:Self-published source

[11] Шаблон:Cite web Шаблон:Self-published source

[12] How To Add DNSSEC Support To Google Chrome

[13] ttps://bugzilla.mozilla.org/show_bug.cgi?id=672600

[14] ttps://bugzilla.mozilla.org/show_bug.cgi?id=1479423

[15] ttps://addons.mozilla.org/en-US/firefox/addon/dnssec-dane-validator/

[16] Шаблон:Cite web Шаблон:Self-published source

[17] Шаблон:Cite web

[postfix-dane-18] Шаблон:Cite web

[powermta-dane-19] Шаблон:Cite web

[exim-dane-20] Шаблон:Cite web

[prosody-dane-21] Шаблон:Cite web

[theguardian-posteo-german-way-22] Шаблон:Cite web

[23] Шаблон:Citation Шаблон:Self-published source

[24] Шаблон:Cite web Шаблон:Self-published source

[25] Шаблон:Cite web Шаблон:Self-published source

[26] Шаблон:Cite journal

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

[24]

[25]

[26]

Партнерские ресурсы
Криптовалюты	Обмен криптовалют - www.bestchange.ru Криптовалютная биржа CoinEx Криптовалютная биржа Binance HIVE OS - операционная система для майнинга e4pool - Мультивалютный пул для майнинга.
Магазины	AliExpress — глобальная виртуальная (в Интернете) торговая площадка, предоставляющая возможность покупать товары производителей из КНР; computeruniverse.net - Интернет-магазин компьютеров(Промо код 5 Евро на первую покупку:FWWC3ZKQ);
Хостинг	DigitalOcean - американский провайдер облачных инфраструктур, с главным офисом в Нью-Йорке и с центрами обработки данных по всему миру;
Разное	Викиум - Онлайн-тренажер для мозга Like Центр - Центр поддержки и развития предпринимательства. Gamersbay - лучший магазин по бустингу для World of Warcraft. Ноотропы OmniMind N°1 - Усиливает мозговую активность. Повышает мотивацию. Улучшает память. Санкт-Петербургская школа телевидения - это федеральная сеть образовательных центров, которая имеет филиалы в 37 городах России. Lingualeo.com — интерактивный онлайн-сервис для изучения и практики английского языка в увлекательной игровой форме. Junyschool (Джунискул) – международная школа программирования и дизайна для детей и подростков от 5 до 17 лет, где ученики осваивают компьютерную грамотность, развивают алгоритмическое и креативное мышление, изучают основы программирования и компьютерной графики, создают собственные проекты: игры, сайты, программы, приложения, анимации, 3D-модели, монтируют видео. Умназия - Интерактивные онлайн-курсы и тренажеры для развития мышления детей 6-13 лет SkillBox - это один из лидеров российского рынка онлайн-образования. Среди партнеров Skillbox ведущий разработчик сервисного дизайна AIC, медиа-компания Yoola, первое и самое крупное русскоязычное аналитическое агентство Tagline, онлайн-школа дизайна и иллюстрации Bang! Bang! Education, оператор PR-рынка PACO, студия рисования Draw&Go, агентство performance-маркетинга Ingate, scrum-студия Sibirix, имидж-лаборатория Персона. «Нетология» — это университет по подготовке и дополнительному обучению специалистов в области интернет-маркетинга, управления проектами и продуктами, дизайна, Data Science и разработки. В рамках Нетологии студенты получают ценные теоретические знания от лучших экспертов Рунета, выполняют практические задания на отработку полученных навыков, общаются с экспертами и единомышленниками. Познакомиться со всеми продуктами подробнее можно на сайте https://netology.ru, линейка курсов и профессий постоянно обновляется. StudyBay Brazil – это онлайн биржа для португалоговорящих студентов и авторов! Студент получает уникальную работу любого уровня сложности и больше свободного времени, в то время как у автора появляется дополнительный заработок и бесценный опыт. Автор24 — самая большая в России площадка по написанию учебных работ: контрольные и курсовые работы, дипломы, рефераты, решение задач, отчеты по практике, а так же любой другой вид работы. Сервис сотрудничает с более 70 000 авторов. Более 1 000 000 работ уже выполнено. StudyBay – это онлайн биржа для англоязычных студентов и авторов! Студент получает уникальную работу любого уровня сложности и больше свободного времени, в то время как у автора появляется дополнительный заработок и бесценный опыт.