{"id":34921,"date":"2019-10-31T22:01:17","date_gmt":"2019-10-31T19:01:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas\/"},"modified":"2019-10-31T22:01:17","modified_gmt":"2019-10-31T19:01:17","slug":"est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","title":{"rendered":"Existuje n\u00e1zor: technologie DANE pro prohl\u00ed\u017ee\u010de selhala","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mluv\u00edme o tom, co je technologie DANE pro autentizaci dom\u00e9nov\u00fdch jmen pomoc\u00ed DNS a pro\u010d se \u0161iroce neprosadila v prohl\u00ed\u017ee\u010d\u00edch.<\/p>\n

\"Existuje<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Paulius Dragunas<\/a><\/noindex><\/i><\/p>\n

Co je DANE<\/h2>\n

\nCertifika\u010dn\u00ed autority (CA) jsou organizace, kter\u00e9 se zab\u00fdvaj\u00ed<\/a><\/noindex> ov\u011b\u0159uj\u00ed kryptografick\u00e9 SSL certifik\u00e1t\u016f<\/a><\/noindex>certifik\u00e1ty. Na n\u011b umis\u0165uj\u00ed sv\u016fj elektronick\u00fd podpis, \u010d\u00edm\u017e potvrzuj\u00ed jejich pravost. N\u011bkdy v\u0161ak vznikaj\u00ed situace, kdy jsou certifik\u00e1ty vyd\u00e1v\u00e1ny s poru\u0161en\u00edm pravidel. Nap\u0159\u00edklad loni Google inicioval \"proceduru ukon\u010den\u00ed d\u016fv\u011bry\" v\u016f\u010di certifik\u00e1t\u016fm Symantec kv\u016fli jejich kompromitaci (o t\u00e9to historii jsme podrobn\u011b psali na na\u0161em blogu \u2014 jedna<\/a><\/noindex> a dva<\/a><\/noindex>).<\/p>\n

Aby se p\u0159ede\u0161lo takov\u00fdm situac\u00edm, p\u0159ed n\u011bkolika lety v IETF za\u010dali vyv\u00edjet<\/a><\/noindex> technologii DANE (ale ta se \u0161iroce neprosadila v prohl\u00ed\u017ee\u010d\u00edch \u2014 o d\u016fvodech pozd\u011bji).<\/p>\n

DANE (DNS-based Authentication of Named Entities) je soubor specifikac\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed pou\u017e\u00edvat DNSSEC (roz\u0161\u00ed\u0159en\u00ed zabezpe\u010den\u00ed syst\u00e9mu n\u00e1zv\u016f) pro kontrolu platnosti SSL certifik\u00e1t\u016f. DNSSEC p\u0159edstavuje roz\u0161\u00ed\u0159en\u00ed pro syst\u00e9m dom\u00e9nov\u00fdch jmen, kter\u00e9 minimalizuje \u00fatoky spojen\u00e9 s podvrh\u00e1n\u00edm adres. Pou\u017eit\u00edm obou t\u011bchto technologi\u00ed m\u016f\u017ee webmaster nebo klient kontaktovat jednoho z provozovatel\u016f z\u00f3n DNS a potvrdit platnost pou\u017eit\u00fdch certifik\u00e1t\u016f.<\/p>\n

V podstat\u011b DANE funguje jako samopodepsan\u00fd certifik\u00e1t (garantem jeho spolehlivosti je DNSSEC) a dopl\u0148uje funkcionalitu CA.<\/p>\n

Jak to funguje<\/h2>\n

\nSpecifikace DANE je pops\u00e1na v RFC6698<\/a><\/noindex>. Podle dokumentu byl do zdrojov\u00fdch z\u00e1znam\u016f DNS<\/a><\/noindex> p\u0159id\u00e1n nov\u00fd typ \u2014 TLSA. Ten obsahuje informace o p\u0159en\u00e1\u0161en\u00e9m certifik\u00e1tu, jeho velikosti a typu p\u0159en\u00e1\u0161en\u00fdch dat, stejn\u011b jako samotn\u00e1 data. Webmaster vytvo\u0159\u00ed digit\u00e1ln\u00ed otisk certifik\u00e1tu, podep\u00ed\u0161e jej pomoc\u00ed DNSSEC a um\u00edst\u00ed do TLSA.<\/p>\n

Klient se p\u0159ipoj\u00ed na web a porovn\u00e1 jeho certifik\u00e1t s \"kopi\u00ed\", kterou z\u00edskal od oper\u00e1tora DNS. Pokud se shoduj\u00ed, zdroj se pova\u017euje za d\u016fv\u011bryhodn\u00fd.<\/p><\/blockquote>\n

\nNa wiki str\u00e1nce DANE je uveden n\u00e1sleduj\u00edc\u00ed p\u0159\u00edklad DNS dotazu k serveru example.org na TCP portu 443:<\/p>\n

IN TLSA _443._tcp.example.org<\/code><\/pre>\n
\nOdpov\u011b\u010f vypad\u00e1 takto:<\/p>\n
 _443._tcp.example.com. IN TLSA (\n   3 0 0 30820307308201efa003020102020... )\n<\/code><\/pre>\n
\nDANE m\u00e1 n\u011bkolik roz\u0161\u00ed\u0159en\u00ed, kter\u00e1 funguj\u00ed s jin\u00fdmi DNS z\u00e1znamy krom\u011b TLSA. Prvn\u00ed je DNS z\u00e1znam SSHFP pro ov\u011b\u0159ov\u00e1n\u00ed kl\u00ed\u010d\u016f p\u0159i SSH spojen\u00edch. Je pops\u00e1n v RFC4255<\/a><\/noindex>,\u00a0RFC6594<\/a><\/noindex>\u00a0a\u00a0RFC7479<\/a><\/noindex>. Druh\u00e9 \u2014 z\u00e1znam OPENPGPKEY pro v\u00fdm\u011bnu kl\u00ed\u010d\u016f pomoc\u00ed PGP (RFC7929<\/a><\/noindex>). Nakonec t\u0159et\u00ed \u2014 z\u00e1znam SMIMEA (ve standardu RFC nen\u00ed zpracov\u00e1n, existuje pouze jeho n\u00e1vrh<\/a><\/noindex>) pro kryptografickou v\u00fdm\u011bnu kl\u00ed\u010d\u016f podle S\/MIME.<\/p>\n
Jak\u00fd je probl\u00e9m s DANE<\/h2>\n
\nV polovin\u011b kv\u011btna se konala konference DNS-OARC (to je neziskov\u00e1 organizace, kter\u00e1 se zab\u00fdv\u00e1 bezpe\u010dnostn\u00edmi, stabiln\u00edmi a rozvojov\u00fdmi ot\u00e1zkami syst\u00e9mu dom\u00e9nov\u00fdch jmen). Na jedn\u00e9 z panelov\u00fdch diskuz\u00ed odborn\u00edci dosp\u011bli k z\u00e1v\u011bru<\/a><\/noindex>, \u017ee technologie DANE v prohl\u00ed\u017ee\u010d\u00edch selhala (alespo\u0148 v aktu\u00e1ln\u00ed implementaci). P\u0159\u00edtomn\u00fd na konferenci Geoff Huston, hlavn\u00ed v\u011bdeck\u00fd pracovn\u00edk APNIC<\/a><\/noindex>, jednoho z p\u011bti region\u00e1ln\u00edch registr\u00e1tor\u016f internetu, se vyj\u00e1d\u0159il<\/a><\/noindex> o DANE jako o \u201emrtv\u00e9 technologii\u201c.<\/p>\n
Popul\u00e1rn\u00ed prohl\u00ed\u017ee\u010de nepodporuj\u00ed autentifikaci certifik\u00e1t\u016f pomoc\u00ed DANE. Na trhu se objevuj\u00ed speci\u00e1ln\u00ed pluginy<\/a><\/noindex>, kter\u00e9 odhaluj\u00ed funk\u010dnost TLSA z\u00e1znam\u016f, av\u0161ak i jejich podpora postupn\u011b uhas\u00edn\u00e1<\/a><\/noindex>.<\/p><\/blockquote>\n
\nProbl\u00e9my s roz\u0161\u00ed\u0159en\u00edm DANE v prohl\u00ed\u017ee\u010d\u00edch se spojuj\u00ed s d\u00e9lkou valida\u010dn\u00edho procesu podle DNSSEC. Syst\u00e9m je nucen prov\u00e1d\u011bt kryptografick\u00e9 v\u00fdpo\u010dty pro potvrzen\u00ed pravosti SSL certifik\u00e1tu a proj\u00edt cel\u00fdm \u0159et\u011bzcem DNS server\u016f (od ko\u0159enov\u00e9 z\u00f3ny po dom\u00e9nu hostitele) p\u0159i prvn\u00edm p\u0159ipojen\u00ed k zdroji.<\/p>\n
\"Existuje
\n\/ Unsplash \/ Kaley Dykstra<\/a><\/noindex><\/i><\/p>\n
Tento nedostatek se sna\u017eili vy\u0159e\u0161it v Mozille pomoc\u00ed mechanismu DNSSEC Chain Extension<\/a><\/noindex> pro TLS. M\u011bl sn\u00ed\u017eit po\u010det DNS z\u00e1znam\u016f, kter\u00e9 bylo t\u0159eba prozkoumat klientem b\u011bhem autentifikace. Av\u0161ak uvnit\u0159 v\u00fdvoj\u00e1\u0159sk\u00e9 skupiny do\u0161lo k neshod\u00e1m, kter\u00e9 nebyly vy\u0159e\u0161eny. Nakonec byl projekt opu\u0161t\u011bn, a\u010dkoliv byl schv\u00e1len IETF v b\u0159eznu 2018.<\/p>\n
Dal\u0161\u00edm d\u016fvodem n\u00edzk\u00e9 popularity DANE je slab\u00e1 roz\u0161\u00ed\u0159enost DNSSEC na sv\u011bt\u011b \u2014 funguje s n\u00edm pouze 19 % zdroj\u016f<\/a><\/noindex>. Odborn\u00edci dosp\u011bli k n\u00e1zoru, \u017ee to nen\u00ed dostate\u010dn\u00e9 pro aktivn\u00ed propagaci DANE.<\/p>\n
Je pravd\u011bpodobn\u00e9, \u017ee se pr\u016fmysl bude vyv\u00edjet jin\u00fdm sm\u011brem. M\u00edsto toho, aby pou\u017e\u00edval DNS k verifikaci certifik\u00e1t\u016f SSL\/TLS, hr\u00e1\u010di na trhu naopak budou propagovat protokoly DNS-over-TLS (DoT) a DNS-over-HTTPS (DoH). Ten posledn\u00ed jsme zm\u00ednili v jednom z na\u0161ich p\u0159edchoz\u00edch materi\u00e1l\u016f<\/a><\/noindex> na Habr. \u0160ifruj\u00ed a kontroluj\u00ed po\u017eadavky u\u017eivatel\u016f na DNS servery, \u010d\u00edm\u017e zabra\u0148uj\u00ed zlo\u010dinc\u016fm ve fale\u0161n\u00fdch datov\u00fdch manipulac\u00edch. Na za\u010d\u00e1tku roku DoT ji\u017e zavedli<\/a><\/noindex> v Google pro sv\u016fj ve\u0159ejn\u00fd DNS. Co se t\u00fd\u010de DANE \u2014 zda se technologii poda\u0159\u00ed \"vr\u00e1tit se do sedla\" a st\u00e1t se masovou, to uk\u00e1\u017ee budoucnost.<\/p>\n
Co dal\u0161\u00edho m\u00e1me pro dopl\u0148kov\u00e9 \u010dten\u00ed:<\/b><\/p>\n
\"Existuje Jak automatizovat \u0159\u00edzen\u00ed IT infrastruktury \u2013 diskutujeme o t\u0159ech trendech<\/a><\/noindex>
\n\"Existuje JMAP \u2014 otev\u0159en\u00fd protokol nahrad\u00ed IMAP p\u0159i v\u00fdm\u011bn\u011b e-mail\u016f<\/a><\/noindex><\/p>\n
\"Existuje Jak u\u0161et\u0159it pomoc\u00ed aplika\u010dn\u00edho programov\u00e9ho rozhran\u00ed<\/a><\/noindex>
\n\"Existuje DevOps v cloudov\u00e9 slu\u017eb\u011b na p\u0159\u00edkladu 1cloud.ru<\/a><\/noindex>
\n\"Existuje Evoluce architektury cloudu 1cloud<\/a><\/noindex><\/p>\n
\"Existuje Jak funguje technick\u00e1 podpora 1cloud<\/a><\/noindex>
\n\"Existuje M\u00fdty o cloudov\u00fdch technologi\u00edch<\/a><\/noindex><\/p><\/blockquote>\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445. \/ Unsplash \/ Paulius Dragunas \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DANE \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b (CA) \u2014 \u044d\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041e\u043d\u0438 \u0441\u0442\u0430\u0432\u044f\u0442 \u043d\u0430 \u043d\u0438\u0445 \u0441\u0432\u043e\u044e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0440\u043e\u0439 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Existuje n\u00e1zor: technologie DANE pro prohl\u00ed\u017ee\u010de selhala | ProHoster","description":"Mluv\u00edme o tom, co je technologie DANE pro autentizaci dom\u00e9nov\u00fdch jmen pomoc\u00ed DNS a pro\u010d se \u0161iroce neprosadila v prohl\u00ed\u017ee\u010d\u00edch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0441\u0442\u044c \u043c\u043d\u0435\u043d\u0438\u0435: \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0430\u043b\u0438\u043b\u0430\u0441\u044c | ProHoster","og:description":"\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:17+00:00","article:modified_time":"2019-10-31T19:01:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34921","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:28","updated":"2026-01-21 21:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/34921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=34921"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/34921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/26289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=34921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=34921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=34921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}