Subject: [dane] dual use of TLSA RR

From: "[email-masked]" <[email-masked]>
Date: Fri, 10 Oct 2014 02:36:42 +1100

is it possible & legal to incorporate 2 TLSA RRs in a zone file the
following way for the same protocol/port ie. 25:

assume postfix has setup 2 certs; an RSA and ECDSA

if it's possible how would a particular TLSA RR be chosen ?
is it based upon negotiated cipher ?

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 9 Oct 2014 16:27:52 +0000

> following way for the same protocol/port ie. 25:

Yes, absolutely.  Multiple TLSA RRs can and will appear in a TLSA
RRset, either as a result of key rotation in progress, or because
there are multiple keys valid at the same time.

> Assume postfix has setup 2 certs; an RSA and ECDSA
> 
> If it's possible how would a particular TLSA RR be chosen?

Each TLSA RRs is compared against the server's chain until one
matches.

> Is it based upon negotiated cipher?

No, generally the TLSA RR does not signal a particular public key
algorithm.  With matching type Full(0) one could infer the algorithm
from public key, but in practice it is easier to just compare the
bits regardless.

-- 
	Viktor.

---

From: "[email-masked]" <[email-masked]>
Date: Sat, 11 Oct 2014 02:19:36 +1100

thanks,

> there are multiple keys valid at the same time.

i signed my zonefile ok and have the following:

_25._tcp.ns1.example.net. IN CNAME tlsa311._dane.example.net.

tlsa311._dane.example.net. IN TLSA 3 1 1
4e02a17b48f8dd3fb451871222278d248c3f51ea5f25ec2e06f65096c80391b0 ; ECC

tlsa311._dane.example.net. IN TLSA 3 1 1
9ff5a335ddb86c368a9b3fc49d1a81f738d57f8f8f96c973e87513bbf24532c3 ; RSA

im waiting for confirmation from somebody that they see "Verified TLS
conn..."

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 10 Oct 2014 15:27:50 +0000

> 9ff5a335ddb86c368a9b3fc49d1a81f738d57f8f8f96c973e87513bbf24532c3 ; RSA

Note this thread is no longer on topic for DANE WG discussion (if
it ever was).  This is an IEF working group, not a help forum.
You can ask routine operational questions on postfix-users or
a DNS users list (if there is one).

> im waiting for confirmation from somebody that they see "Verified TLS

Rather unlikely, with the domain name obfuscated as example.net.

-- 
	Viktor.