Subject: [dane] SubjectPublicKeyInfo claimed but X.509 hash is present

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 12 Oct 2012 17:59:18 +0200

In two of the sites that were previously sent for testing in this list
have an issue. Even though in their DANE entry they claim to contain a
SubjectPublicKeyInfo hash, in reality they contain a hash of the X.509
certificate.

One of these sites is being listed as valid in:
http://www.internetsociety.org/deploy360/resources/dane-test-sites/

The sites with issues are:
dane.nox.su 030101
forfun.net 010101

The 3 first bytes of the TLSA entry are also above.  The issue is in the
"Selector" field which has 1 instead of zero.

I contacted the forfun.net admin who said that he just used the dane.py
script. Is this known or am I missing something?

regards,
Nikos

---

From: Paul Wouters <[email-masked]>
Date: Fri, 12 Oct 2012 13:07:39 -0400 (EDT)

> script. Is this known or am I missing something?

The dane.py script was an old script based on an earlier draft, and the
usage had different meanings then. They should use a more modern tool
to generate TLSA records. The hash-slinger tlsa command, swede or
ldns-dane (coming in the next version of ldns) are known to be good.

Paul

---

From: "Alex Venedioukhin (lists)" <[email-masked]>
Date: Fri, 12 Oct 2012 22:51:42 +0400

> The sites with issues are:

Fixed for dane.nox.su.

The 1 was in selector field just because the DANE-plugin for Firefox
(Extended DNSSEC Validator) seems to use the selector in such a way.
Well, there is still a TYPE65468 record in dane.nox.su with 030101 -
so the plugin works.

Regards,
Alexander Venedioukhin,
http://dxdt.ru/

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 12 Oct 2012 22:24:09 +0200

> ldns-dane (coming in the next version of ldns) are known to be good.

I've also added a tool to generate dane TLSA entries in the latest gnutls.

regards,
Nikos

---

From: Ben Laurie <[email-masked]>
Date: Tue, 16 Oct 2012 12:01:28 +0100

> I've also added a tool to generate dane TLSA entries in the latest gnutls.

Hmm, good point, I should add that to OpenSSL.

>
> regards,
> Nikos
>
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane