Subject: [dane] trying to understand dane better

From: Jigar Joshi <[email-masked]>
Date: Wed, 6 May 2015 17:45:51 -0700

I was using this https://www.dnssec-validator.cz/

I got this icon

for a local network url which is over http (no https support for that url)
however hovering over still says secured by dnssec

my understanding is it compares the fingerprint of certificate with one
dnssec says to check identify of host

https://www.dnssec-validator.cz/pages/documentation.html

doesn't list this icon (in orange color specifically and hovering over says
secured by dnssec)

if it is not using https how can it compare fingerprint ?

-- 
--
Jigar

---

From: Warren Kumari <[email-masked]>
Date: Tue, 12 May 2015 17:05:55 +0200

On Thu, May 7, 2015 at 2:45 AM, Jigar Joshi <[email-masked]> wrote:

> doesn't list this icon (in orange color specifically and hovering over
> says secured by dnssec)
>

It isn't / it doesn't.

I'm not 100% sure what the orange color means (and I don't have the plugin
installed at the moment), but the first / "key" icon is only about DNSSEC.
DNSSEC simply proves that the *DNS* data hasn't been changed ( actually
that is a huge oversimplification, see :
http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions)

The second icon (://, changes to a padlock) is the "DANE" icon. ://  means:
"For an existing domain name this means that no HTTPS secured connection to
the remote server was established. Therefore, you can not perform TLSA
record validation. The authenticity of TLS/SSL remote server certificate
for the domain name could not be verified by DANE protocol because the
connection to the remote server is not realized via HTTPS protocol."

W

>
>
> --
> --
> Jigar
>
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: Jigar Joshi <[email-masked]>
Date: Tue, 12 May 2015 22:47:33 -0700

Hi Warren,

How can it validate that dns data hasn't been modified if it doesn't have
ssl certificate, what I understood was it checks finger print you get
against the fingerprint it has published at dns to validate, however if the
domain doesn't have ssl support at all how does it work ? please clarify if
I totally misudnerstood this

Thanks!
Jigar

On Tue, May 12, 2015 at 8:05 AM, Warren Kumari <[email-masked]> wrote:

>> for a local network url which is over http (no https support for that
>> url) however hovering over still says secured by dnssec
>>
> "For an existing domain name this means that no HTTPS secured connection
> to the remote server was established. Therefore, you can not perform TLSA
> I don't think the execution is relevant when it was obviously a bad idea
> in the first place.

-- 
--
Jigar

---

From: Warren Kumari <[email-masked]>
Date: Wed, 13 May 2015 10:14:42 +0200

> I totally misudnerstood this

Yup, you have completely misunderstood -- this has nothing do to with DANE
(or SSL / TLS), it is all DNSSEC.

I'd suggest you read some of the DNSSEC background information. Some
examples:
http://www.internetsociety.org/deploy360/dnssec/
http://archive.icann.org/meetings/buenosaires2013/en/schedule/mon-dnssec-everybody/presentation-dnssec-everybody-18nov13-en.html

This list is probably not the right place for these questions.
W

>> I'm not 100% sure what the orange color means (and I don't have the
>> plugin installed at the moment), but the first / "key" icon is only about
>> DNSSEC. DNSSEC simply proves that the *DNS* data hasn't been changed (
>> actually that is a huge oversimplification, see :