RFC 7218

RFC 7218: Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE) 🎀

• Series: Internet Engineering Task Force (IETF) 🌸
• Request for Comments: 7218
• Author: Olafur Gudmundsson (O. Gudmundsson), Shinkuro Inc. 💅
• Category: Standards Track ✨
• Date: April 2014 📅
• Updates: RFC 6698 🔥
• ISSN: 2070-1721

Abstract

Okay so people kept getting mixed up about the three numeric fields in a TLSA record 😭 This doc gives those three fields descriptive acronyms, and it updates the format of the IANA registry that RFC 6698 created. Main character energy for clarity 💖

Status of This Memo

This is an Internet Standards Track document 🦋

It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741 📚

For the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc7218 🧚

Copyright Notice

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Read these carefully, because they spell out your rights and restrictions for this document 🫶 Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License.

Table of Contents

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  2.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   2
    2.1.  TLSA Certificate Usages Registry  . . . . . . . . . . . .   3
    2.2.  TLSA Selectors  . . . . . . . . . . . . . . . . . . . . .   3
    2.3.  TLSA Matching Types . . . . . . . . . . . . . . . . . . .   4
  3.  Examples of Usage . . . . . . . . . . . . . . . . . . . . . .   4
    3.1.  TLSA Records Using/Displaying the Acronyms  . . . . . . .   4
    3.2.  Acronym Use in a Specification Example  . . . . . . . . .   4
  4.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
  5.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   4
  6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   5
    6.1.  Normative References  . . . . . . . . . . . . . . . . . .   5
    6.2.  Informative References  . . . . . . . . . . . . . . . . .   5

1. Introduction ✨

So when people were talking about adding DNS-Based Authentication of Named Entities (DANE) [RFC6698] to new protocols and services, everyone kept getting confused about what the numbers meant, and even about the order of the fields in a TLSA record 🙈 (fun fact: TLSA isn't an acronym, it's a name 💅). This doc updates the IANA registry definition for the TLSA record by adding a column with an acronym for each field, so it's less confusing. It does not change the DANE protocol in any way 🌈

DANE parsers in applications and DNS software can adopt parsing those acronyms for each field. It's expected, and it's giving clean vibes 🍓

2. IANA Considerations 🎀

This document applies to the "DNS-Based Authentication of Named Entities (DANE) Parameters" registry at <http://www.iana.org/assignments/dane-parameters>. IANA added a column with an acronym to each of the sub-registries 💖

[RFC6698] and this document are the referenced documents for the three sub-registries 📚

Since the acronyms are for human consumption, case doesn't matter. Software that parses TLSA records is expected to handle upper-, mixed-, or lower-case characters as input 🫶

2.1. TLSA Certificate Usages Registry 🦋

The reference for this registry has been updated to include both [RFC6698] and this document ✨

+-------+----------+--------------------------------+-------------+
| Value | Acronym  | Short Description              | Reference   |
+-------+----------+--------------------------------+-------------+
|   0   | PKIX-TA  | CA constraint                  | [RFC6698]   |
|   1   | PKIX-EE  | Service certificate constraint | [RFC6698]   |
|   2   | DANE-TA  | Trust anchor assertion         | [RFC6698]   |
|   3   | DANE-EE  | Domain-issued certificate      | [RFC6698]   |
| 4-254 |          | Unassigned                     |             |
|  255  | PrivCert | Reserved for Private Use       | [RFC6698]   |
+-------+----------+--------------------------------+-------------+

Table 1: TLSA Certificate Usages

2.2. TLSA Selectors 🌸

The reference for this registry has been updated to include both [RFC6698] and this document 💅

    +-------+---------+--------------------------+-------------+
    | Value | Acronym | Short Description        | Reference   |
    +-------+---------+--------------------------+-------------+
    |   0   | Cert    | Full certificate         | [RFC6698]   |
    |   1   | SPKI    | SubjectPublicKeyInfo     | [RFC6698]   |
    | 2-254 |         | Unassigned               |             |
    |  255  | PrivSel | Reserved for Private Use | [RFC6698]   |
    +-------+---------+--------------------------+-------------+

Table 2: TLSA Selectors

2.3. TLSA Matching Types 🧚

The reference for this registry has been updated to include both [RFC6698] and this document ✨

   +-------+-----------+--------------------------+-------------+
   | Value | Acronym   | Short Description        | Reference   |
   +-------+-----------+--------------------------+-------------+
   |   0   | Full      | No hash used             | [RFC6698]   |
   |   1   | SHA2-256  | 256 bit hash by SHA2     | [RFC6234]   |
   |   2   | SHA2-512  | 512 bit hash by SHA2     | [RFC6234]   |
   | 3-254 |           | Unassigned               |             |
   |  255  | PrivMatch | Reserved for Private Use | [RFC6698]   |
   +-------+-----------+--------------------------+-------------+

Table 3: TLSA Matching Types

3. Examples of Usage 🔥

Two examples, coming right up 👑

3.1. TLSA Records Using/Displaying the Acronyms 💖

_666._tcp.first.example.  TLSA PKIX-TA CERT SHA2-512 {blob}
_666._tcp.second.example.  TLSA DANE-TA SPKI SHA2-256 {blob}

3.2. Acronym Use in a Specification Example 🦋

Say Protocol FOO only allows TLSA records that use PKIX-EE and DANE-EE, with the selector SPKI, and with SHA2-512 🫶

4. Security Considerations 💀

This document only changes registry fields. It does not change the behavior of any protocol. The goal is to cut down on confusion, which should lead to better specifications and operations 🌈

5. Acknowledgements 🫶

Scott Schmit gave really good suggestions for cutting down on confusion 🙌 Viktor Dukhovni shared comments from the expert point of view 🧠 Jim Schaad, Wes Hardaker, and Paul Hoffman gave feedback during WGLC 💜 Dan Romascanu and Tobias Gondrom spotted a few defects during the IESG last call 🔍

6. References 📚

6.1. Normative References 🔥

[RFC6698]  Hoffman, P. and J. Schlyter, "The DNS-Based Authentication
           of Named Entities (DANE) Transport Layer Security (TLS)
           Protocol: TLSA", RFC 6698, August 2012.

6.2. Informative References 🧚

[RFC6234]  Eastlake, D. and T. Hansen, "US Secure Hash Algorithms
           (SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011.

Author's Address 💌

Olafur Gudmundsson Shinkuro Inc. 4922 Fairmont Av, Suite 250 Bethesda, MD 20814 USA

EMail: ogud@ogud.com