Security/DNSSEC-TLS - Revision history

Ladamski at 03:07, 7 February 2012

2012-02-07T03:07:44Z

← Older revision		Revision as of 03:07, 7 February 2012
Line 16:		Line 16:
	{{FeatureInfo		{{FeatureInfo
	\|Feature priority=Unprioritized		\|Feature priority=Unprioritized
			\|Feature theme=Security Leadership
	\|Feature roadmap=Platform		\|Feature roadmap=Platform
	\|Feature secondary roadmap=Security		\|Feature secondary roadmap=Security
	}}		}}
	{{FeatureTeamStatus}}		{{FeatureTeamStatus}}

Ladamski at 22:38, 2 February 2012

2012-02-02T22:38:47Z

← Older revision		Revision as of 22:38, 2 February 2012
Line 17:		Line 17:
	\|Feature priority=Unprioritized		\|Feature priority=Unprioritized
	\|Feature roadmap=Platform		\|Feature roadmap=Platform
			\|Feature secondary roadmap=Security
	}}		}}
	{{FeatureTeamStatus}}		{{FeatureTeamStatus}}

Asa at 21:44, 29 July 2011

2011-07-29T21:44:31Z

← Older revision		Revision as of 21:44, 29 July 2011
Line 16:		Line 16:
	{{FeatureInfo		{{FeatureInfo
	\|Feature priority=Unprioritized		\|Feature priority=Unprioritized
			\|Feature roadmap=Platform
	}}		}}
	{{FeatureTeamStatus}}		{{FeatureTeamStatus}}

Dkeeler at 21:56, 20 July 2011

2011-07-20T21:56:14Z

← Older revision		Revision as of 21:56, 20 July 2011
Line 12:		Line 12:
	\|Feature users and use cases=Server administrators can put key/certificate information in DNS records they control (e.g. TLSA records). This information is verifiable through DNSSEC. The browser can then use this in place of or alongside certificate chain validation.		\|Feature users and use cases=Server administrators can put key/certificate information in DNS records they control (e.g. TLSA records). This information is verifiable through DNSSEC. The browser can then use this in place of or alongside certificate chain validation.
	\|Feature functional spec=https://wiki.mozilla.org/Security/DNSSEC-TLS-details		\|Feature functional spec=https://wiki.mozilla.org/Security/DNSSEC-TLS-details
			\|Feature implementation notes=Tracking bug: [https://bugzilla.mozilla.org/show_bug.cgi?id=672239 672239]
	}}		}}
	{{FeatureInfo		{{FeatureInfo

Dkeeler at 17:29, 15 July 2011

2011-07-15T17:29:08Z

← Older revision		Revision as of 17:29, 15 July 2011
Line 17:		Line 17:
	}}		}}
	{{FeatureTeamStatus}}		{{FeatureTeamStatus}}
	~~{\| class="fullwidth-table"~~
	\|-
	~~\| style="font-weight: bold; background: #DDD;" \| Feature~~
	~~\| style="font-weight: bold; background: #DDD;" \| Status~~
	~~\| style="font-weight: bold; background: #DDD;" \| ETA~~
	~~\| style="font-weight: bold; background: #DDD;" \| Owner~~
	\|-
	~~<section begin="status" />~~
	~~\| [[Security/DNSSEC-TLS\|DNSSEC-TLS]]~~
	~~\| {{StatusHealthy\|status=Internal demonstration implementation}}~~
	~~\| 2011-09-01~~
	~~\| [[User:dkeeler\|David Keeler]]~~
	~~<section end="status" />~~

	\|}

	~~This set of pages documents the TLS domain validation through DNSSEC project. These documents are currently a work in progress. There are likely many errors.~~

	~~== Summary ==~~

	~~This project aims to implement domain validation in TLS sessions through use of DNSSEC chains.~~

	~~== Team ==~~

	~~Who's working on this?~~

	*'''Feature Manager''':
	*'''Lead Developer''': [[User:dkeeler\|David Keeler]]
	*'''Product Manager''':
	*'''QA''':
	*'''Security''':
	*'''Privacy''':

	~~== Release Requirements ==~~

	~~The release requirements include a fully working and well tested implementation of this feature. This includes a server implementation. Currently nginx is being targeted as the server of choice.~~

	~~== Next Steps & Open Issues ==~~

	*{{done\|Complete external implementation}}
	*{{done\|Complete in-browser demo implementation}}
	*{{new\|Get someone to look at what I've written to make sure it's not totally off the mark}}
	*{{new\|Complete in-browser implementation}}

	~~== Related Bugs & Dependencies ==~~

	~~[https://bugzilla.mozilla.org/show_bug.cgi?id=589537 bug 589357]~~

	~~This feature depends on servers with the ability to send DNSSEC chains. Nginx has been modified to support this, as described in a document to come.~~

	~~== Risks ==~~

	~~Risks are discussed in the [[Security/DNSSEC-TLS-details#Security Considerations\|security considerations]] section of the detailed design page.~~

	~~== Use Cases ==~~

	~~The use case is anyone running an HTTPS server and anyone wishing to connect to that server using Firefox.~~

	~~== Designs ==~~

	~~Design specifications are detailed [[Security/DNSSEC-TLS-details\|here]].~~

	~~== Test Plans ==~~

	~~Test plans are [[Security/DNSSEC-TLS-details#Test Plans\|here]].~~

	~~== Goals ==~~
	Implement domain validation for TLS connections using DNSSEC in Firefox. That is, in addition to sending a certificate in the TLS handshake, a server would send sufficient DNSSEC records to convince the client of its identity and establish public key material.

	~~== Non-Goals ==~~

	~~To be updated as issues arise.~~

	~~== Other Stuff ==~~

	~~There is currently no other stuff.~~

	~~== Legend (remove if you like) ==~~

	~~{\| class="fullwidth-table"~~
	\|-
	~~\| {{StatusHealthy\|status= }}~~
	~~\| Healthy: feature is progressing as expected.~~
	\|-
	~~\| {{StatusBlocked\|status= }}~~
	~~\| Blocked: feature is currently blocked.~~
	\|-
	~~\| {{StatusAtRisk\|status= }}~~
	~~\| At Risk: feature is at risk of missing its targeted release.~~
	\|-
	~~\| '''ETA'''~~
	~~\| Estimated date for completion of the current feature task. Overall ETA for the feature is the product release date.~~
	\|}

	~~__NOTOC__~~

	~~Please remove this line and any non-relevant categories below. Add whatever other categories you feel are appropriate.~~

	~~[[Category:Features]] [[Category:Firefox]] [[Category:Platform]] [[Category:Security]]~~

Dkeeler at 17:26, 15 July 2011

2011-07-15T17:26:00Z

← Older revision		Revision as of 17:26, 15 July 2011
Line 1:		Line 1:
			{{FeatureStatus
			\|Feature name=DNSSEC-TLS
			\|Feature stage=Development
			\|Feature status=In progress
			\|Feature health=OK
			}}
			{{FeatureTeam
			\|Feature lead engineer=David Keeler
			}}
			{{FeaturePageBody
			\|Feature overview=This feature performs domain validation in TLS sessions by using DNSSEC chains.
			\|Feature users and use cases=Server administrators can put key/certificate information in DNS records they control (e.g. TLSA records). This information is verifiable through DNSSEC. The browser can then use this in place of or alongside certificate chain validation.
			\|Feature functional spec=https://wiki.mozilla.org/Security/DNSSEC-TLS-details
			}}
			{{FeatureInfo
			\|Feature priority=Unprioritized
			}}
			{{FeatureTeamStatus}}
	{\| class="fullwidth-table"		{\| class="fullwidth-table"
	\|-		\|-

Dkeeler: /* Next Steps & Open Issues */

2011-07-15T17:03:57Z

Next Steps & Open Issues

← Older revision		Revision as of 17:03, 15 July 2011
Line 40:		Line 40:
	*{{done\|Complete external implementation}}		*{{done\|Complete external implementation}}
	*{{done\|Complete in-browser demo implementation}}		*{{done\|Complete in-browser demo implementation}}
			*{{new\|Get someone to look at what I've written to make sure it's not totally off the mark}}
	*{{new\|Complete in-browser implementation}}		*{{new\|Complete in-browser implementation}}

Dkeeler: /* Related Bugs & Dependencies */

2011-07-08T00:03:48Z

Related Bugs & Dependencies

← Older revision		Revision as of 00:03, 8 July 2011
Line 43:		Line 43:

	== Related Bugs & Dependencies ==		== Related Bugs & Dependencies ==

			[https://bugzilla.mozilla.org/show_bug.cgi?id=589537 bug 589357]

	This feature depends on servers with the ability to send DNSSEC chains. Nginx has been modified to support this, as described in a document to come.		This feature depends on servers with the ability to send DNSSEC chains. Nginx has been modified to support this, as described in a document to come.

	~~[https://bugzilla.mozilla.org/show_bug.cgi?id=589537 \| bug 589357]~~

	== Risks ==		== Risks ==

Dkeeler: /* Related Bugs & Dependencies */

2011-07-08T00:03:18Z

Related Bugs & Dependencies

← Older revision		Revision as of 00:03, 8 July 2011
Line 45:		Line 45:

	This feature depends on servers with the ability to send DNSSEC chains. Nginx has been modified to support this, as described in a document to come.		This feature depends on servers with the ability to send DNSSEC chains. Nginx has been modified to support this, as described in a document to come.

			[https://bugzilla.mozilla.org/show_bug.cgi?id=589537 \| bug 589357]

	== Risks ==		== Risks ==

Dkeeler: /* Next Steps & Open Issues */

2011-07-07T23:02:01Z

Next Steps & Open Issues

← Older revision		Revision as of 23:02, 7 July 2011
Line 39:		Line 39:

	*{{done\|Complete external implementation}}		*{{done\|Complete external implementation}}
	*{{ok\|Complete in-browser demo implementation}}		*{{done\|Complete in-browser demo implementation}}
	*{{new\|Complete in-browser implementation}}		*{{new\|Complete in-browser implementation}}

← Older revision		Revision as of 17:03, 15 July 2011
Line 40:		Line 40:
	*{{done\|Complete external implementation}}		*{{done\|Complete external implementation}}
	*{{done\|Complete in-browser demo implementation}}		*{{done\|Complete in-browser demo implementation}}
			*{{new\|Get someone to look at what I've written to make sure it's not totally off the mark}}
	*{{new\|Complete in-browser implementation}}		*{{new\|Complete in-browser implementation}}

← Older revision		Revision as of 23:02, 7 July 2011
Line 39:		Line 39:

	*{{done\|Complete external implementation}}		*{{done\|Complete external implementation}}
	*{{ok\|Complete in-browser demo implementation}}		*{{done\|Complete in-browser demo implementation}}
	*{{new\|Complete in-browser implementation}}		*{{new\|Complete in-browser implementation}}