{"id":34921,"date":"2019-10-31T22:01:17","date_gmt":"2019-10-31T19:01:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas\/"},"modified":"2019-10-31T22:01:17","modified_gmt":"2019-10-31T19:01:17","slug":"est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","title":{"rendered":"Er is een mening: de DANE-technologie voor browsers is mislukt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

We discuss what the DANE technology for authenticating domain names via DNS entails and why it has not gained widespread adoption in browsers.<\/p>\n

\"Er<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Paulius Dragunas<\/a><\/noindex><\/i><\/p>\n

What is DANE<\/h2>\n

\nCertificate Authorities (CAs) are organizations that are involved in<\/a><\/noindex> certifying cryptographic SSL-certificaten<\/a><\/noindex>. They affix their electronic signature, confirming authenticity. However, there can be situations where certificates are issued improperly. For example, last year Google initiated a 'trust termination' process for Symantec certificates due to their compromise (we covered this story in our blog \u2014 one<\/a><\/noindex> en two<\/a><\/noindex>).<\/p>\n

To prevent such situations, a few years ago, IETF began developing<\/a><\/noindex> the DANE technology (but it has not seen widespread adoption in browsers \u2014 we will discuss why further).<\/p>\n

DANE (DNS-based Authentication of Named Entities) is a set of specifications that allows using DNSSEC (Domain Name System Security Extensions) to control the validity of SSL certificates. DNSSEC is an extension for the domain name system that minimizes address substitution attacks. By using these two technologies, a webmaster or client can reach one of the DNS zone operators and confirm the validity of the certificate in use.<\/p>\n

Essentially, DANE acts as a self-signed certificate (its reliability is guaranteed by DNSSEC) and supplements the functions of CAs.<\/p>\n

Hoe het werkt<\/h2>\n

\nThe DANE specification is described in RFC6698<\/a><\/noindex>. According to the document, a new type was added to the resource records of DNS<\/a><\/noindex> \u2014 TLSA. It contains information about the transmitted certificate, dimensions and type of transmitted data, as well as the data itself. The webmaster creates a digital fingerprint of the certificate, signs it with DNSSEC, and publishes it in TLSA.<\/p>\n

The client connects to the website and compares its certificate with the 'copy' received from the DNS operator. If they match, the resource is considered trusted.<\/p><\/blockquote>\n

\nOn the DANE wiki page, the following example DNS request is provided to the server example.org on TCP port 443:<\/p>\n

IN TLSA _443._tcp.example.org<\/code><\/pre>\n
\nThe response looks like this:<\/p>\n
 _443._tcp.example.com. IN TLSA (\n   3 0 0 30820307308201efa003020102020... )\n<\/code><\/pre>\n
\nDANE has several extensions that work with other DNS records besides TLSA. The first is the DNS record SSHFP for key verification during SSH connections. This is described in RFC4255<\/a><\/noindex>,\u00a0RFC6594<\/a><\/noindex>\u00a0en\u00a0RFC7479<\/a><\/noindex>. Het tweede is een OPENPGPKEY-record voor het uitwisselen van sleutels via PGP (RFC7929<\/a><\/noindex>). Ten slotte is het derde een SMIMEA-record (de standaard in de RFC is niet officieel, er is alleen een conceptversie<\/a><\/noindex>) voor cryptografische sleuteluitwisseling via S\/MIME.<\/p>\n
Wat is het probleem met DANE<\/h2>\n
\nIn het midden van mei vond de DNS-OARC-conferentie plaats (dit is een non-profitorganisatie die zich bezighoudt met kwesties van veiligheid, stabiliteit en ontwikkeling van het domeinnaamsysteem). Op een van de panels kwamen de experts tot de conclusie<\/a><\/noindex>, dat de DANE-technologie in browsers faalde (tenzij we kijken naar de huidige implementatie). Geoff Huston, een senior researcher APNIC<\/a><\/noindex>, een van de vijf regionale internetregisters, sprak<\/a><\/noindex> over DANE als een 'dode technologie'.<\/p>\n
Populaire browsers ondersteunen geen certificaatauthenticatie via DANE. Op de markt zijn er speciale plugins<\/a><\/noindex>, die de functionaliteit van TLSA-records blootleggen, maar ook hun ondersteuning wordt geleidelijk stopgezet.<\/a><\/noindex>.<\/p><\/blockquote>\n
\nDe problemen met de verspreiding van DANE in browsers worden in verband gebracht met de lange validatieprocessen via DNSSEC. Het systeem moet cryptografische berekeningen uitvoeren om de authenticiteit van het SSL-certificaat te bevestigen en moet tijdens de eerste verbinding met de bron de hele keten van DNS-servers doorlopen (van de rootzone tot het hostdomein).<\/p>\n
\"Er
\n\/ Unsplash \/ Kaley Dykstra<\/a><\/noindex><\/i><\/p>\n
Deze tekortkoming probeerden ze in Mozilla op te lossen met behulp van de DNSSEC Chain Extension<\/a><\/noindex> voor TLS. Dit moest het aantal DNS-records verminderen dat de client tijdens de authenticatie moest doornemen. Echter, binnen de ontwikkelaarsgroep ontstonden meningsverschillen die niet opgelost konden worden. Uiteindelijk werd het project stopgezet, hoewel het in maart 2018 door de IETF was goedgekeurd.<\/p>\n
Een andere reden voor de lage populariteit van DANE is de beperkte verspreiding van DNSSEC in de wereld \u2014 slechts 19% van de bronnen werkt ermee<\/a><\/noindex>. Experts hebben vastgesteld dat dit onvoldoende is voor een actieve promotie van DANE.<\/p>\n
Waarschijnlijk zal de industrie zich in een andere richting ontwikkelen. In plaats van DNS te gebruiken voor de verificatie van SSL\/TLS-certificaten, zullen marktspelers daarentegen de protocollen DNS-over-TLS (DoT) en DNS-over-HTTPS (DoH) promoten. Laatstgenoemde hebben we genoemd in een van onze vorige artikelen<\/a><\/noindex> op Habr. Ze coderen en controleren gebruikersverzoeken naar de DNS-server, waardoor kwaadwillenden geen kans krijgen om gegevens te vervalsen. Begin dit jaar heeft DoT al ge\u00efmplementeerd<\/a><\/noindex> in Google voor zijn openbare DNS. Wat betreft DANE - of de technologie 'terug op de been' kan komen en toch massaal kan worden, zal in de toekomst moeten blijken.<\/p>\n
Wat hebben we nog meer voor verdere lectuur:<\/b><\/p>\n
\"Er Hoe IT-infrastructuurbeheer te automatiseren - we bespreken drie trends<\/a><\/noindex>
\n\"Er JMAP - een open protocol dat IMAP vervangt voor e-mailuitwisseling<\/a><\/noindex><\/p>\n
\"Er Hoe te besparen met behulp van een toepasselijke API<\/a><\/noindex>
\n\"Er DevOps in de cloudservice aan de hand van 1cloud.ru<\/a><\/noindex>
\n\"Er De evolutie van cloudarchitectuur 1cloud<\/a><\/noindex><\/p>\n
\"Er Hoe de technische ondersteuning van 1cloud werkt<\/a><\/noindex>
\n\"Er Mythen over cloudtechnologie\u00ebn<\/a><\/noindex><\/p><\/blockquote>\n
Bron: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445. \/ Unsplash \/ Paulius Dragunas \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DANE \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b (CA) \u2014 \u044d\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041e\u043d\u0438 \u0441\u0442\u0430\u0432\u044f\u0442 \u043d\u0430 \u043d\u0438\u0445 \u0441\u0432\u043e\u044e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0440\u043e\u0439 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Er is een mening: de DANE-technologie voor browsers is mislukt | ProHoster","description":"We discuss what the DANE technology for authenticating domain names via DNS entails and why it has not gained widespread adoption in browsers.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0441\u0442\u044c \u043c\u043d\u0435\u043d\u0438\u0435: \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0430\u043b\u0438\u043b\u0430\u0441\u044c | ProHoster","og:description":"\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:17+00:00","article:modified_time":"2019-10-31T19:01:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34921","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:28","updated":"2026-01-21 21:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/34921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=34921"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/34921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/26289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=34921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=34921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=34921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}