• Home
  • Archive
  • Tools
  • Contact Us

The Customize Windows

Technology Journal

  • Cloud Computing
  • Computer
  • Digital Photography
  • Windows 7
  • Archive
  • Cloud Computing
  • Virtualization
  • Computer and Internet
  • Digital Photography
  • Android
  • Sysadmin
  • Electronics
  • Big Data
  • Virtualization
  • Downloads
  • Web Development
  • Apple
  • Android
Advertisement
You are here:Home » What is DANE Protocol?

By Abhishek Ghosh September 11, 2016 6:33 am Updated on September 11, 2016

What is DANE Protocol?

Advertisement

Previously we discussed about DNSSEC. DNSSEC is a method of authenticating DNS records that also uses a chain of trust. The trust structure is identical to the DNS hierarchy. But What is DANE Protocol? DANE stands for DNS-based Authentication of Named Entities. DANE Uses the DNS System to Store Fingerprint to Certify Which CA the Domain Uses to Protect From Security Breeches. DANE is a network protocol intended to secure in a way so that the used certificates of domain can not be substituted, thus increasing the safety while transporting encrypted emails and accessing websites. With DANE either the public key or entire certificate may be put in a DNS record which specifies the certificate or public key to be used for connecting to the domain over tcp port 443.

 

What is DANE Protocol : Basics and RFC

 

If a user with a browser as a client wants to establish a secure TLS connection to a web page about https://thecustomizewindows.com and wants to ensure that the responding server is also legitimized to deliver the desired website for this, the client first checks whether that domain name is entered in the certificate provided by the server. TLS sessions require a chain of trust to authenticate the server to the client. That is commonly used method. Trusted root certificates are issued by Certificate Authorities (CA). But it is still not ensured that the certificate came from a trusted certification authority (CA). CAs are considered trustworthy, so the browser automatically uses a list of trusted CAs, which in turn as Trust Anchors for the certificate hierarchy of the client certificate. So, currently this is achieved through a series of PKIX certificates that link the server’s certificate to a trusted root certificate stored by the client. However, many serious incidents gave rise to doubts about the safety of this procedure. The administrator is bypassed to certify CAs certificates for the domain. Currently, no technical mechanism exists that can prevents any authority from signing a certificate for any domain name.

At this point is where DANE came. Clients can ask the DNS Servers which certificates can be trusted. Therefore a new DNS Resource Record named TLSA is defined. This includes a certificate in PKIX format whose fingerprint or public key is used. In this three types of responses are possible:

Advertisement

---

  1. Service Certificate Constraint : The client asked to accept only a defined certificate. The certificate itself needs to check for trustworthiness.
  2. Domain-Issued Certificate: The client is asked to trust the reference in TLSA record certificate. An examination of the trust hierarchy is not performed.
  3. Trust Anchor Assertion: The client is asked to use the validation of the certificate from a defined Trust Anchor. The certificate must be its chain of trust to this purpose and pass the certification test.

Service Certificate constraint entries thus serve to confirm output of public Roots certificates. Domain Issued Certificates give the domain holder the possibility to issue for its own TLS-secured services. Trust Anchor Assertion is finally in self-operated in private certification of the bodies relevant to Trust Anchor.

RFC 6698 defines DANE as a way to authenticate TLS client and server entities without a certificate authority (CA). Updated operational and deployment guidance is defined in RFC 7671, RFC 7672 defines application specific usage of DANE and RFC 7673 for using DANE with Service (SRV) records. DANE can also be used by domain owners to issue their own certificates, without an existing certificate authority.

 

What is DANE Protocol Related DNS Record?

 

DANE uses a new record types called TLSA. From the text under sub header “What is DANE Protocol : Basics and RFC”, we can get four possibilities, they are types of policies :

  • Usage Number 0 – CA specification – Specifies the Certificate Authority (CA) who will provide TLS certificates for the domain. We can only say that the domain will use TLS certificates from a specific CA.  Like we are using Geotrust as CA. It only will allow Geotrust. It is difficult to get a SSL/TLS certificate from Geotrust without being WE.
  • Usage Number 1 – Specific TLS certificate – Specifies the exact TLS certificate that should be used for the domain. Like we are using Geotrust’s specific certificate for this domain. CA can not be from Let’s Encrypt at this moment (Let’s Encrypt recommends using 2 or 3). This should be commonest case.
  • Usage Number 2 – Trust anchor assertion – Specifies the trust anchor to be used for validating the TLS certificates for the domain. It is basically for CA’s own websites.
  • Usage Number 3 – Domain-issued certificate – Specifies the exact TLS certificate that should be used for the domain, but certificate can be self-signed certificate. It is basically just a security.

We can write the above as :

  1. Certificate Authority Constraint (0 – PKIX-TA)
  2. Service Certificate Constraint (1 – PKIX-EE)
  3. Trust Anchor Assertion (2 – DANE-TA)
  4. Domain Issued Certificate (3 – DANE-EE)

As Case 2 is obvious usage, that Service Certificate Constraint (1 – PKIX-EE) is commonly used. That is Usage 1 of RFC. This is called TLSA Certificate usage value.

As we can either use the full certificate or pin, we will have two selector fields :

  1. Using full certificate (0 – Cert)
  2. Using subject public key (1 – SPKI)

As we commonly use full certificate to generate it, it is almost always 0. This is known as TLSA selector value.

From the type of encryption, we can have :

  1. No Hash (0 – Full)
  2. SHA-256 hash (1 – SHA-256)
  3. SHA-512 hash (2 – SHA-512)

As SHA 256 is a sane hash, 1 will be common value. This is known as TLSA Matching Type.

Above three information can be written as [number] [number] [number] like 101, 301 etc. As we are generating a hash, it is a data. Second second of information is :

  1. port
  2. protocol
  3. domain name
what-is-dane-protocol

We can write in this way :

Vim
1
[port] [protocol][domain name][number] [number] [number] [hash value of pin]

If you run this command for a domain named example.com

Vim
1
dig +dnssec +noall +answer +multi _443._tcp.example.com. TLSA

you will get one output like ours a TLSA record :

Vim
1
_443._tcp.thecustomizewindows.com. 30 IN TLSA 1 0 1 (67F709959C5CD3D97E1F57B355701E95A9D881119A8FE4E6770903086DFFB356 )

That value 30 is time to live. Obviously, DNS provider needs to support it. Dyn does support it. How that bizarre data  :

Vim
1
67F709959C5CD3D97E1F57B355701E95A9D881119A8FE4E6770903086DFFB356

came?

It is generated by running a command against the certificate. Obviously it is added via DNS.

Tagged With DANE protocol , DANE srv portprotocol
Facebook Twitter Pinterest

Abhishek Ghosh

About Abhishek Ghosh

Abhishek Ghosh is a Businessman, Surgeon, Author and Blogger. You can keep touch with him on Twitter - @AbhishekCTRL.

Here’s what we’ve got for you which might like :

Articles Related to What is DANE Protocol?

  • Steps to Create & Add DANE TLSA Record

    Here Are the Steps to Create & Add DANE TLSA Record From TLS/SSL Certificate in Command Line Interface on SSH and Add on Your DNS Record.

  • Optimizing Nginx HTTP/2 TLS : Basic Principles

    We hope that most of the readers are using latest version of deb GNU/Linux (like Ubuntu 16.04 LTS) or latest CentOS which fully supports HTTP/2. In case you are using Ubuntu 14.04 or older Ubuntu, please read our old guide to upgrade your server to make compatible with HTTP/2. This Article on Optimizing Nginx HTTP/2 TLS […]

  • What is a Code Signing Certificate for Microsoft Developers?

    Code tampering can be disastrous since it’s done with malicious intentions. The main motto of attackers for tampering with software codes is to invade customer data privacy. But, apart from that, gaining unauthorized control on the codes, modifying them to change their behaviour, disabling security protocols, installing backdoor gateways, inserting malicious codes via injections, altering […]

  • What is CAA DNS Record And How to Add?

    CA/Browser Forum voted to make CAA mandatory which be in action by September 2017. Here is Our Guide Around CAA DNS Record And How to Add It.

performing a search on this website can help you. Also, we have YouTube Videos.

Take The Conversation Further ...

We'd love to know your thoughts on this article.
Meet the Author over on Twitter to join the conversation right now!

If you want to Advertise on our Article or want a Sponsored Article, you are invited to Contact us.

Contact Us

Subscribe To Our Free Newsletter

Get new posts by email:

Please Confirm the Subscription When Approval Email Will Arrive in Your Email Inbox as Second Step.

Search this website…

 

Popular Articles

Our Homepage is best place to find popular articles!

Here Are Some Good to Read Articles :

  • Cloud Computing Service Models
  • What is Cloud Computing?
  • Cloud Computing and Social Networks in Mobile Space
  • ARM Processor Architecture
  • What Camera Mode to Choose
  • Indispensable MySQL queries for custom fields in WordPress
  • Windows 7 Speech Recognition Scripting Related Tutorials

Social Networks

  • Pinterest (24.3K Followers)
  • Twitter (5.8k Followers)
  • Facebook (5.7k Followers)
  • LinkedIn (3.7k Followers)
  • YouTube (1.3k Followers)
  • GitHub (Repository)
  • GitHub (Gists)
Looking to publish sponsored article on our website?

Contact us

Recent Posts

  • Market Segmentation in BriefSeptember 20, 2023
  • What is Booting?September 18, 2023
  • What is ncurses?September 16, 2023
  • What is JTAG in Electronics?September 15, 2023
  • iPhone 15 Pro Max Vs Samsung Galaxy S22/S23 UltraSeptember 14, 2023
PC users can consult Corrine Chorney for Security.

Want to know more about us?

Read Notability and Mentions & Our Setup.

Copyright © 2023 - The Customize Windows | dESIGNed by The Customize Windows

Copyright  · Privacy Policy  · Advertising Policy  · Terms of Service  · Refund Policy