3 ms·

There is a better way than CT: DANE, with query name minimization to prevent MITMing of some domains (as opposed to none or all) by a malicious or compromised .

There is a better way than CT: DANE, with query name minimization to prevent MITMing of some domains (as opposed to none or all) by a malicious or compromised . or TLD. DANE means you get a real PKI with real name constraints, unlike WebPKI. DANE stapling can reduce latency, but doing DANE w/ qname minimization for most of the domainname being resolved has the property that you get to make life really hard for a malicious or compromised . or TLD. You get to cache a lot of results, so using DANE stapling for the stem of the domainname should still reduce latency a fair bit. With DNS over TLS or HTTPS we're seeing that resolvers are willing to use TCP, which is one answer to the DNS amplification attack concern.

josephg 4y ago
What’s the status on DANE? Is it supported in any modern web browsers? Is it gaining any traction?
- Koenvh 4y ago
  DANE is gaining adoption primarily when it comes to email - browsers are still hesitant.
  - LeonM 4y ago
    I don't understand why you are being downvoted, since you are right. For example: Microsoft has recently adopted DANE validation for outbound email, are planning to add TLSA records for their inbound email 'by the end of 2022. [0] [0] https://techcommunity.microsoft.com/t5/exchange-team-blog/releasing-outbound-smtp-dane-with-dnssec/ba-p/3100920 https://techcommunity.microsoft.com/t5/exchange-team-blog/re...
  - tptacek 4y ago
    Browsers have refused to implement DANE for the last ten years. In the meantime, the major email players came up with MTA-STS, and alternative to DANE that cites lack of DNSSEC adoption as one of its rationales. If you send email today, it's vanishingly unlikely that any DNSSEC will happen; email is complicated and email infrastructure tends to shut people's brains off (I know it does for me) but you can just look at the tiny slice of domains that are actually DNSSEC signed and see that there's no meaningful adoption.
Avamander 4y ago
You're just trading one PKI for an another with DANE. One that has way less transparency.
- cryptonector 4y ago
  First of all, this is not worse than WebPKI. CT or no CT, you won't catch CAs MITMing you until it's too late, and even with CT you depend utterly on the sites you visit actually auditing CT. Second of all, with DANE with QName minimization the parent CAs (zones) don't know what you'll be asking of the ones below, so either they MITM you for all your requests or none of them or they have to have other context to decide when to MITM you. The one bit of context they really want but don't get to have -if you minimize queries- is the full domainname you're trying to resolve, so it's hard for them to decide whether to MITM you. And you can catch DNS zones lying because you can a) perform the same lookups in different networks, b) you can download, cache, and check . and TLDs so you can catch those lying (which is 99% of the battle). But most importantly, you get real, strong name constraints.
  - Avamander 4y ago
    It very much is. > CT or no CT, you won't catch CAs MITMing you until it's too late, and even with CT you depend utterly on the sites you visit actually auditing CT. You won't catch a malicious nameserver operator, if they wish to MITM a specific victim, ever. There's no monitoring at all. While utterly depending on the fact they even enforce DNSSEC. What's worse is that DNSSEC keys tend to live very long, if those are compromised, it will probably be abusable for years. > a) perform the same lookups in different networks, b) you can download, cache, and check . and TLDs so you can catch those lying (which is 99% of the battle). But if you're not the victim, it's unlikely you'll ever notice as a site operator. CT in that sense is different and much better as you can't rely on end-users reporting these things. DNSSEC right now is a much much worse PKI than WebPKI is.
garaetjjte 4y ago
DANE (and generally anything that depends on DNSSEC) is dead technology at this point, with zero adoption in browsers. Arguably it offers less protection against malicious TLD or root because you don't get any logs. (well, you could require both with PKIX-EE mode, but that's getting really complicated to configure)
tptacek 4y ago
DANE stapling died in committee at the IETF; there's no solid answer for how to implement it in a way where an attacker with control of a root certificate can't strip it off a TLS session, and if you assume an attacker can't control a WebPKI root certificate, DANE isn't serving any purpose either. Meanwhile: DANE and CT don't have the same functionality at all. DANE defines away the need for transparency by saying that the PKI will be operated by entities we all intrinsically and completely trust (world governments). CT says "we don't trust the PKI at all, so let's log it". A lack of any kind of DANE transparency log is one small reason among many that DANE isn't taken seriously.

josephg 4y ago

What’s the status on DANE? Is it supported in any modern web browsers? Is it gaining any traction?

Koenvh 4y ago
DANE is gaining adoption primarily when it comes to email - browsers are still hesitant.
- LeonM 4y ago
  I don't understand why you are being downvoted, since you are right. For example: Microsoft has recently adopted DANE validation for outbound email, are planning to add TLSA records for their inbound email 'by the end of 2022. [0] [0] https://techcommunity.microsoft.com/t5/exchange-team-blog/releasing-outbound-smtp-dane-with-dnssec/ba-p/3100920 https://techcommunity.microsoft.com/t5/exchange-team-blog/re...
- tptacek 4y ago
  Browsers have refused to implement DANE for the last ten years. In the meantime, the major email players came up with MTA-STS, and alternative to DANE that cites lack of DNSSEC adoption as one of its rationales. If you send email today, it's vanishingly unlikely that any DNSSEC will happen; email is complicated and email infrastructure tends to shut people's brains off (I know it does for me) but you can just look at the tiny slice of domains that are actually DNSSEC signed and see that there's no meaningful adoption.

Avamander 4y ago

You're just trading one PKI for an another with DANE. One that has way less transparency.

cryptonector 4y ago
First of all, this is not worse than WebPKI. CT or no CT, you won't catch CAs MITMing you until it's too late, and even with CT you depend utterly on the sites you visit actually auditing CT. Second of all, with DANE with QName minimization the parent CAs (zones) don't know what you'll be asking of the ones below, so either they MITM you for all your requests or none of them or they have to have other context to decide when to MITM you. The one bit of context they really want but don't get to have -if you minimize queries- is the full domainname you're trying to resolve, so it's hard for them to decide whether to MITM you. And you can catch DNS zones lying because you can a) perform the same lookups in different networks, b) you can download, cache, and check . and TLDs so you can catch those lying (which is 99% of the battle). But most importantly, you get real, strong name constraints.
- Avamander 4y ago
  It very much is. > CT or no CT, you won't catch CAs MITMing you until it's too late, and even with CT you depend utterly on the sites you visit actually auditing CT. You won't catch a malicious nameserver operator, if they wish to MITM a specific victim, ever. There's no monitoring at all. While utterly depending on the fact they even enforce DNSSEC. What's worse is that DNSSEC keys tend to live very long, if those are compromised, it will probably be abusable for years. > a) perform the same lookups in different networks, b) you can download, cache, and check . and TLDs so you can catch those lying (which is 99% of the battle). But if you're not the victim, it's unlikely you'll ever notice as a site operator. CT in that sense is different and much better as you can't rely on end-users reporting these things. DNSSEC right now is a much much worse PKI than WebPKI is.

garaetjjte 4y ago

DANE (and generally anything that depends on DNSSEC) is dead technology at this point, with zero adoption in browsers. Arguably it offers less protection against malicious TLD or root because you don't get any logs. (well, you could require both with PKIX-EE mode, but that's getting really complicated to configure)

tptacek 4y ago

DANE stapling died in committee at the IETF; there's no solid answer for how to implement it in a way where an attacker with control of a root certificate can't strip it off a TLS session, and if you assume an attacker can't control a WebPKI root certificate, DANE isn't serving any purpose either. Meanwhile: DANE and CT don't have the same functionality at all. DANE defines away the need for transparency by saying that the PKI will be operated by entities we all intrinsically and completely trust (world governments). CT says "we don't trust the PKI at all, so let's log it". A lack of any kind of DANE transparency log is one small reason among many that DANE isn't taken seriously.