Subject: [keyassure] Chrome support for DNS/DNSSEC interactions with certificate validation.

From: Adam Langley <[email-masked]>
Date: Tue, 7 Sep 2010 11:08:16 -0400

I've been asked to give a brief report on the state of Chrome's
support for features which may interest this group.

Firstly, nothing here should be taken as an official vote of support
from Google. These are simply one of a number of experimental features
in Chrome.

At the moment, --enable-dnssec-certs will trigger these behaviours:

1) Support for embedded DNSSEC chains. The format of which is best
documented in a comment in the source code for now[1].

These allow for an X.509 extension in a certificate to contain enough
records and signatures to prove a record on the target domain. This
can be sufficient to validate a certificate.

I lost the code that I was using to generate these chains in a
reinstall, although that code was crappy anyway. I'll rewrite it,
hopefully soonish.

2) Support for RR lookups.

For each HTTPS site accessed, an DNS resolution will be attempted to
get records on that domain name. (For the moment, too many, redundant
resolutions are attempted. I need to fix that.) The RRs can cause the
rejection of a certificate (without DNSSEC) or acceptance of a
certificate (with DNSSEC). Here 'DNSSEC' is currently defined as a
response from a nameserver on 127.0.0.1 with the AD bit set. I worry a
little that some local DNS proxies may echo the AD bit but it's the
best, simple solution for the moment.

For each of these, the records in question are currently TXT records
with a format which matches Dan Kaminsky's tools.

[1] http://src.chromium.org/viewvc/chrome/trunk/src/net/base/dnssec_chain_verifier.cc?revision=57787&view=markup

-- 
Adam Langley [email-masked] http://www.imperialviolet.org