Subject: [dane] existence proof

From: [email-masked]
Date: Tue, 17 Jan 2012 19:39:30 +0000

are there any zones with DANE (or proto-DANE) RRs in them that are visible?

/bill

---

From: Scott Schmit <[email-masked]>
Date: Sat, 21 Jan 2012 17:55:03 -0500

> are there any zones with DANE (or proto-DANE) RRs in them that are visible?

$ dig +short TYPE65468 _443._tcp.ulthar.us
\# 35 01010162D5414CD1CC657E3D30EA5E6D0136E92306E725413C616A51 CAB4B852C70A1C
$ dig +short TYPE65468 _443._tcp.www.ulthar.us
\# 35 01010162D5414CD1CC657E3D30EA5E6D0136E92306E725413C616A51 CAB4B852C70A1C

That should be consistent with the current DANE draft.

There's also Matt McCutchen's site (mattmccutchen.net), which uses an
older draft (-06).

I don't know of any others.

-- 
Scott Schmit

---

From: Tom Ritter <[email-masked]>
Date: Sat, 21 Jan 2012 23:31:16 -0500

> I don't know of any others.

Mike Cardwell has his set up also, along with SSH, PGP, and DKIM:
https://grepular.com/Understanding_DNSSEC

$ dig +short TYPE65468 _443._tcp.grepular.com
\# 35 010101FDA20E60D267270D6E009C196B323C33D3EB7BFC8AF0E8FE4C F7BF563CB5A55D

-tom

---

From: Simon Arlott <[email-masked]>
Date: Sun, 22 Jan 2012 16:18:08 +0000

> I don't know of any others.

I've added these based on draft 14:

HTTPS
$ dig _443._tcp.lp0.eu type65468 +short
_tlsa.proxima.lp0.eu.
\# 67 010102490D884C778E9031D8F1BDFB4B6E7673418BAD66CB8115E36C ED911EA612B688AE7CC1909BF23391574E41865E41A51E03ECBC18FA 6125A5A14C7D2BA5E0CFF3

SMTP (TLS)
$ dig arlott.org mx +short
0 proxima.lp0.eu.
5 blackhole.arlott.org.uk.

$ dig _smtp._tcp.arlott.org srv +short
0 10 25 blackhole.arlott.org.uk.
0 90 25 proxima.lp0.eu.

$ dig _25._tcp.proxima.lp0.eu type65468 +short
_tlsa.proxima.lp0.eu.
\# 67 010102490D884C778E9031D8F1BDFB4B6E7673418BAD66CB8115E36C ED911EA612B688AE7CC1909BF23391574E41865E41A51E03ECBC18FA 6125A5A14C7D2BA5E0CFF3

$ dig _25._tcp.blackhole.arlott.org.uk type65468 +short
_tlsa.blackhole.arlott.org.uk.
\# 67 0101025654772D26434FB13DCEAF9F26C5C51A886471DC90A6965194 F4018E80F8965232FAEDDB22A4039A0EBE017DD4E48055DF12659451 52D6C489CEC2EA8D2A5A7D

XMPP (TLS)
$ dig _xmpp-server._tcp.arlott.org.uk srv +short
0 0 5269 proxima.lp0.eu.

$ dig _5269._tcp.proxima.lp0.eu type65468 +short
_tlsa.proxima.lp0.eu.
\# 67 010102490D884C778E9031D8F1BDFB4B6E7673418BAD66CB8115E36C ED911EA612B688AE7CC1909BF23391574E41865E41A51E03ECBC18FA 6125A5A14C7D2BA5E0CFF3

I'm assuming the following command is correct to calculate a hash
of SubjectPublicKeyInfo:

$ openssl x509 -pubkey -in ... | openssl rsa -pubin | \
	head -n -1 | tail -n +2 | base64 -d | sha512sum -
writing RSA key
490d884c778e9031d8f1bdfb4b6e7673418bad66cb8115e36ced911ea612b688ae7cc1909bf23391574e41865e41a51e03ecbc18fa6125a5a14c7d2ba5e0cff3  -

It matches the record for ulthar.us:

$ dig _443._tcp.ulthar.us type65468 +short
\# 35 01010162D5414CD1CC657E3D30EA5E6D0136E92306E725413C616A51 CAB4B852C70A1C

$ openssl s_client -showcerts -connect ulthar.us:443 </dev/null 2>/dev/null | \
	openssl x509 -pubkey | openssl rsa -pubin | \
	head -n -1 | tail -n +2 | base64 -d | sha256sum -
writing RSA key
62d5414cd1cc657e3d30ea5e6d0136e92306e725413c616a51cab4b852c70a1c  -

-- 
Simon Arlott