[keyassure] Firefox 4 (beta) add-on for certificate validations using DNSSEC

[Pieter Lange <[e-mail]>]

We're students from the System and Network Engineering master at the
University of Amsterdam and have almost completed our one month project
under supervision of NLnet.
The topic was related to issue #8 (securing last hop) and other subjects
you're discussing here, so we think you might be interested.

During last month we've been following the list, reading your draft for
securing TLS certificate associations and have implemented an add-on for
the new Firefox 4 beta. This add-on is inspired[1] on the DNSSEC
validator by NIC.CZ, but does much more.

Actual DNSSEC trust chain validation is performed by implementing
libunbound[2], unlike the original add-on -- that just checked if the
'ad' flag was set and by no means informed users that the 'ad' can be faked.

Additionally, the add-on requests TXT and TLSA records for the same
label. The TXT implementation is based on Dan Kaminsky's spec[3] as it
is a nice showcase for what's possible. Note that we will remove support
for TXT record lookup when dane is nearing consensus on all issues.

The add-on currently only supports doing sha1 validation for both TXT
and TLSA records; full certificates (cert type 2) or 'parent' (cert type
3/4) certificates are not supported. And there must be a thousand and
one more things wrong with it; we are not by any means saying this is a
proper way to verify certificates yet. Nor do we properly support the
'sts' flag in Kaminsky's specification because of a conflicting rule in
the STS[4] draft specification (doesn't allow self signed certificates).

We are very much aware that you focus on more than just HTTP, but still
this add-on might prove to be a useful tool to evaluate the current drafts.

Bug reports are very welcome but we haven't yet set up our bugtracker.
Please have patience and if you have any immediate concerns contact us
via email.

You can find our add-on at https://os3sec.org, the website of our
education can be found at https://www.os3.nl

Regards,
Danny Groenewegen & Pieter Lange

[1] http://www.dnssec-validator.cz
[2] http://www.unbound.net
[3] http://dankaminsky.com/2010/12/19/dnssec-ch1/
[4] http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-00