What can we learn from existing deployments of the DANE protocol? As more people start implementing DANE in their applications, are there lessons we can learn to feed back into the standards development process? What are the barriers people are finding to using DANE? How can we help accelerate the deployment of DANE and DNSSEC?
As I mentioned in my Rough Guide to IETF 91 post and also my post here on Deploy360, I have a short bit of time at the end of the DANE Working Group agenda on next Wednesday, November 12, 2014, to raise these questions and try to get some feedback. To help with that, I wrote an Internet-Draft that you can find at:
https://tools.ietf.org/html/draft-york-dane-deployment-observations
In the document, I outline some of the concerns and issues that I have observed related to DANE deployment, including:
- Lack of awareness of DANE
- Challenges creating TLSA records
- Inability to enter TLSA records at DNS hosting operators
- Availability of developer libraries
- Perception that DANE is only for self-signed certificates
- Performance concerns
- Cryptographic concerns
I then offered these questions for discussion:
- What roadblocks are people running into with implementing DANE? (outside of the broader issue of getting DNSSEC validation and signing more widely available) are there lessons we can feed back into our process of developing DANE-related standards?
- Are there more “Using DANE with ” types of documents that we can or should create? (And who is willing to do so?)
- Are there some good examples/case studies of DANE implementations that we could perhaps capture as informational RFCs? (The Jabber community’s implementation comes to mind)
- Are there places where it would be helpful if there were reference implementations of DANE support? For example, DANE for email got a boost when support was added to postfix. Are there other commonly-used open source projects where the addition of DANE support would help move deployment along?
- Are there test tools that need to be developed? Or existing ones that need to be better promoted? Are there interop tests we can arrange?
I’m looking forward to the discussion on Wednesday… but I also welcome any comments you may have NOW on this topic. You are welcome to send comments directly to me, send them to the DANE mailing list (you need to subscribe first), post them here as comments to this article – or post them on any of the social networks where this post appears. (although either email or posting the comments here on our site are the best ways to make sure I actually see your comments)
What can we learn from DANE deployment so far – and how can we use that to help get more DANE usage happening?