[dane] DNAMEs and TLSA name checks.

[Viktor Dukhovni <[e-mail]>]

A comment Paul Wouters' OpenPGP drafts leads to an interesting
observation about the interaction of DNAME redirection and TLSA
name checks.

Suppose we have DNAME that designates "b.example" as an alternative
name for "a.example".

Suppose, in a hypothetical universe where browsers implement DANE,
a user browses to <https://www.b.example/>.  The DNSSEC query for the
address records of "www.b.example" will determine that this host
is an alias:

    b.example.	IN DNAME	a.example.
    www.b.example.	IN CNAME	www.a.example.
    ; + related RRSIGs proving the DNAME "secure"

In our hypothetical universe, there are TLSA records of the form:

    _443._tcp.www.a.example. IN TLSA DANE-TA Cert SHA2-256 {blob}
    ; + related RRSIGs proving the TLSA RRset "secure"

If the user's browser does not follow the advice of the DANE ops
draft, it will look for TLSA records at the original dns name,
that is not CNAME expanded:

    _443._tcp.www.b.example. IN TLSA ?

Because of the DNAME it will see the same TLSA RRset:

    b.example.	IN DNAME	a.example.
    _443._tcp.www.b.example. IN CNAME _443._tcp.www.a.example.
    ; + related RRSIGs proving the DNAME "secure"
    _443._tcp.www.a.example. IN TLSA DANE-TA Cert SHA2-256 {blob}
    ; + related RRSIGs proving the TLSA RRset "secure"

However, its "TLSA" base domain is "www.b.example", thus given a
CU of DANE-TA(2) it will expect the server certificate to include
"www.b.example".  This means that servers would need to carry all
DNAME variant DNS name forms in their certificates.

If, however, CNAME expansion is performed per the OPs draft, the
TLSA base domain will be "www.a.example", and server certificates
need only match the primary domain.

This issue should be rare with SRV and MX records, since the target
of the SRV or MX record is required to not be an alias and the TLSA
base domain is taken from the target of SRV or MX records.

The point of this post is to highlight the interaction of DNAME
records with certificate name checks and why (absent SRV or MX
redirection) TLSA RRs should be sought after CNAME expansion of
the target domain.

The SMTP draft requires similar logic when MTAs allow CNAMEs in
the MX hostname.  I don't recall whether the SRV draft says anything
about CNAME expansion for SRV targets (again not supposed to happen,
but if supported, should probably be CNAME expanded).

-- 
	Viktor.