Subject: [Danish] Walking a trust chain via TLSA records

From: Ash Wilson <[email-masked]>
Date: Wed, 9 Jun 2021 12:58:17 -0700

Bringing this on the list for broader discussion...

How might one discover an entire certificate chain using just TLSA records?
The PKIXCD draft proposes the use of a web URL for certificate chain
discovery, but what if we wanted to do all this via TLSA records and DNSSEC?

Referencing the labeling pattern in
https://www.ietf.org/archive/id/draft-wilson-dane-pkix-cd-01.html#section-3.4,
a proposed pattern might be:

${SKI}.${IDENTITY_DOMAIN}

For a device with DANE ID 12345._device.vendor.example: the CA certificate
which may be used to validate the entity certificate may be found in a TLSA
record at ${SKI}._device.vendor.example, where ${SKI} is the subjectKeyID
of the CA certificate, which is inferred from the authorityKeyID of the
entity certificate.

Any thoughts on this?

-- 

*Ash Wilson* | Technical Director
*e:* [email-masked]

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 9 Jun 2021 16:38:30 -0400

> discovery, but what if we wanted to do all this via TLSA records and DNSSEC?

Can you explain what problem this is intended to solve?  It is
rather unclear why or wherefore "discovering the entire" chain
is something one needs to do.

In many protocols, including e.g. TLS and S/MIME, the presented
signature certificates are a complete chain, and all one needs to do is
validate that chain via a suitable trust-anchor.

With a traditional PKI that trust anchor is one of many static locally
trusted CAs.  With DANE, that trust anchor is provided via a TLSA
record, that chains back via signed DS/DNSKEY pairs to the root DNSKEY
RRSet.

Either way, whatever chain you intended to "discover" should be
presented by whoever signed the message along with the signature.
The only thing remaining to "discover" is the applicable trust
anchor.

-- 
    Viktor.