Subject: [dane] NIST DANE Tester Announcement

From: Stephen Nightingale <[email-masked]>
Date: Wed, 6 Nov 2013 11:58:34 -0500

For those DANEs who are in Vancouver, you can talk to Scott Rose or Doug 
Montgomery about this. Doug will be at the informal DANE lunch tomorrow.

========

NIST has developed a test system for the RFC 6698 DANE protocol. DANE 
seeks to verify PKIX certificate based Transport Layer Security (RFC 
5246 TLS) connections using the Domain Name System as secured by DNSSEC.

https://www.had-pilot.com/dane/danelaw.html

The NIST DANE test system has three modes of operation:

- Test your DANE enabled site:
    Enter the URL of a site for which a DANE TLSA resource record is 
provisioned. The system will negotiate the connection, verify with DANE 
and get the web page - or provide failure diagnostics.

- A reference test set to test your browser in response to all possible 
DANE configurations.

- If your browser is NOT DANE enabled, a reference test set to test a 
DANE client's response to all possible configurations and return the 
results to your browser.

The site is up and available for testing - But it is still early days 
and there may be occasional outages. Please be patient and/or let us know.

Stephen Nightingale, NIST
HAD Pilot Program

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 6 Nov 2013 22:14:42 +0000

On Wed, Nov 06, 2013 at 11:58:34AM -0500, Stephen Nightingale wrote:

> provisioned. The system will negotiate the connection, verify with
> DANE and get the web page - or provide failure diagnostics.
> 
> - A reference test set to test your browser in response to all
> possible DANE configurations.
> 
> - If your browser is NOT DANE enabled, a reference test set to test
> a DANE client's response to all possible configurations and return
> the results to your browser.
> 
> The site is up and available for testing - But it is still early
> days and there may be occasional outages. Please be patient and/or
> let us know.

Yet none of the major browsers are as ye showing interest in DANE.
Perhaps a test-bed for DANE SMTP sites would be more useful in the
near-term, as there is now at least one DANE capable MTA (Postfix),
and another (Exim) coming soon.

If they are interested in test case suggestions, they can get in
touch with me off list.  I am also interested in finding out which
DANE client toolkit they are using.  Publishing that code could
help steer other implementations in the right direction, or help
identify potential problems.

-- 
	Viktor.

---

From: Stephen Nightingale <[email-masked]>
Date: Wed, 6 Nov 2013 17:26:22 -0500

> and another (Exim) coming soon.
DANE SMTP (and SMIMEA) is coming soon.

> identify potential problems.
The NIST DANE tester is implemented in Python over tlslite. I adapted 
the Checker function to do DANE. We'll offer to bundle it with tlslite 
once it's a bit more robust.  We can probably make it available directly 
on the site as well. I'm looking into gnutls too, but more interested in 
pygnutls than C.

Stephen.

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Wed, 6 Nov 2013 15:29:27 -0800

>> https://www.had-pilot.com/dane/danelaw.html

For those of you who prefer a somewhat more simple approach, there is still:

https://check.sidnlabs.nl/dane/

--
Marco

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Wed, 6 Nov 2013 15:59:23 -0800

>> https://www.had-pilot.com/dane/danelaw.html

I don't quite get it... the test-domains.... they don't do DNSSEC properly?

_443._tcp.000.tlsa.good.test.had-pilot.biz for example.... no DS in
had-pilot.biz and no DS in biz?

--
Marco

---

From: Bry8 Star <[email-masked]>
Date: Thu, 07 Nov 2013 04:05:32 -0800

Hi,

Thanks.

Will it be possible to add another textbox/input-field in this
tester-site, for the DANE-signed domain-name that will be tested, to
allow upload of a pem or crt or cer file which will be used with the
HTTPS Web-Server, or with other scheme based server ? or a textbox
to "paste" the cert or cert-chain code from such file.  So that,
test can show result info, by ruling-out that, a TLS/SSL cert or
cert-chain used by the DANE-signed site, was not present in
visitor's/client side web-browser/OS.

My understanding is, such will allow to really TEST the DANE/TLSA
"Usage" 2 and 3 cases.

If you do not have domain owner's (TLSA "Usage" case 2's or 3's)
TLS/SSL cert or cert-chain file, then will not your test-result
always fail for those TWO "Usage" cases ?

- - - - - -

For users to test DANE+DNSSEC from their own location/computer,
mentioned in below is one (or two in long shot) option(s), out of
few other options:

If a local full DNSSEC supported DNS-Server or DNS-Resolver software
is present (for more accurate tests) in local computer or local
(trusted) LAN, or in (local) VM.

Then Mozilla Firefox, upto v24.0, (or other firefox/gecko/XUL-runner
based web-browsers, like: GNU IceCat, Iceweasel, etc), can have
partial DANE awareness, by loading the "Extended DNSSEC Validator"
("EDV", a firefox addon/extension from os3sec.org), this addon helps
to display info/icon related to DANE/TLSA "Usage" 2 & 3, but no
support for Usage 0 or 1 yet, this addon also has DNSSEC awareness
and can display info related to DNSSEC authentications, it can also
display info on SSL/TLS cert verification (and certificate chain
verification), etc.

But, EDV v0.5 (mozilla), v0.6 (github) or v0.8 (github) none worked
on Firefox v25.0 or later, last tested on Nov 5, 2013.  Based on EDV
author's response, it seems, he is not interested now, in continuing
developing anymore.

And, developer/dev-group of "DNSSEC-Validator" (another Firefox
addon, from CZ.NIC) said on mailing list, that they will add support
for DANE from next month.  Currently it supports displaying only
DNSSEC (except DANE) related info/icon.

- - Bright Star.

Received from Stephen Nightingale, on 2013-11-06 8:58 AM:
> 
> For those DANEs who are in Vancouver, you can talk to Scott Rose or
> Doug Montgomery about this. Doug will be at the informal DANE lunch
> tomorrow.
> 
> ========
> 
> NIST has developed a test system for the RFC 6698 DANE protocol.
> DANE seeks to verify PKIX certificate based Transport Layer Security
> (RFC 5246 TLS) connections using the Domain Name System as secured
> by DNSSEC.
> 
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Bry8 Star <[email-masked]>
Date: Thu, 07 Nov 2013 04:35:48 -0800

Users who will run test, should MAKE SURE to upload ONLY the PUBLIC
certificate portion(s), or such certificate-chain portion (which DO
NOT INCLUDE ANY PRIVATE KEY portion) into such textbox.

They SHOULD NOT upload the exact cert file or cert-chain file which
will be used in real HTTPS server or other TLS encrypted
scheme/protocol based Server.  As such file may have private keys.

With such option (to copy-paste PUBLIC certificate codes), Tests
related to "Usage" case 2 & 3 should succeed.

Or, can your test-system pull the "Usage" case 3's TLS cert out of
the TLSA DNS record, if domain-name have declared the FULL TLS cert
code in TLSA ?  and then, can such FULL SSL/TLS cert code be used
for initiating encrypted connection, with the DANE-signed
domain-name based TLS/HTTPS Server/URL ?

- - Bright Star.

Received from Bry8 Star, on 2013-11-07 4:05 AM:
> - - - - -
> - Bright Star.

---

From: Guido Witmond <[email-masked]>
Date: Thu, 07 Nov 2013 13:58:08 +0100

> DNSSEC (except DANE) related info/icon.

Hi, I'm the person who updated the Extended DNSSEC Validator to 0.8 and
submitted it to the original maintainer. Who did publish it.

I was awaiting for their addon as well, as the EDV is a decendant of the
nic.cz DV.

I guess it's time for me to pick up the EDV again.

Guido.

---

From: Stephen Nightingale <[email-masked]>
Date: Thu, 7 Nov 2013 10:03:40 -0500

> https://check.sidnlabs.nl/dane/

This is a potentially useful adjunct for clients that don't do DANE 
validation.
BUT
This is the answer for NIST.gov:
Warning! No TLSA records for _443._tcp.inside.nist.gov. were found.
PKIX validation without DANE will be performed.
129.6.13.244 dane-validated successfully

Maybe you should say that the certificate PKIX validated, rather than 
saying that DANE validated successfully, since there is no TLSA record?

Stephen.

---

From: Stephen Nightingale <[email-masked]>
Date: Thu, 7 Nov 2013 10:16:16 -0500

>If you do not have domain owner's (TLSA "Usage" case 2's or 3's) 
TLS/SSL cert or cert-chain file,
    >then will not your test-result always fail for those TWO "Usage" 
cases ?

For usage 2, Yes. That's probably why Viktor and Wes wrote in section 
3.9.2 of their BCP document that TLSA RR 2 publishers must ensure their 
servers are configured to serve the trust anchor cert as part of a full 
cert chain, when TLS handshaking.  I'm thinking to add annotations to 
that effect in the test site.

Usage 3 specifically does not require PKIX validation, so the root cert 
non-availability is moot.
If DANE comes to be widely deployed and trusted, backed by effective 
DNSSEC, then it seems likely that Usage 3 will come to be the default 
mode of operation, as either 301 or 302, for brevity.

Perhaps I should repeat parts of the BCP in the respective test cases.

Stephen.