This document describes an experimental TLS extension for the in-band transport of the complete set of records that can be validated by DNSSEC and that are needed to perform DNS-Based Authentication of Named Entities (DANE) of a TLS server. This extension obviates the need to perform separate, out-of-band DNS lookups. When the requisite DNS records do not exist, the extension conveys a denial-of-existence proof that can be validated. This experimental extension is developed outside the IETF and is published here to guide implementation of the extension and to ensure interoperability among implementations.
IETF · RFCОфициальная английская аннотация
This document describes an experimental TLS extension for the in-band transport of the complete set of records that can be validated by DNSSEC and that are needed to perform DNS-Based Authentication of Named Entities (DANE) of a TLS server. This extension obviates the need to perform separate, out-of-band DNS lookups. When the requisite DNS records do not exist, the extension conveys a denial-of-existence proof that can be validated. This experimental extension is developed outside the IETF and is published here to guide implementation of the extension and to ensure interoperability among implementations.
{
"id": "RFC9102",
"number": 9102,
"title_en": "TLS DNSSEC Chain Extension",
"title_ru": "",
"summary_ru": "",
"purpose_ru": "",
"use_ru": "",
"full_translation_path": "",
"full_translation_checked_at": "",
"full_translation_source_sha256": "",
"architect_note_ru": "",
"topics_ru": [],
"translation_state": "not_prepared",
"verification_level": "not_prepared",
"verification_level_ru": "Русская выжимка не подготовлена",
"verification_note_ru": "",
"abstract_en": "This document describes an experimental TLS extension for the in-band transport of the complete set of records that can be validated by DNSSEC and that are needed to perform DNS-Based Authentication of Named Entities (DANE) of a TLS server. This extension obviates the need to perform separate, out-of-band DNS lookups. When the requisite DNS records do not exist, the extension conveys a denial-of-existence proof that can be validated. This experimental extension is developed outside the IETF and is published here to guide implementation of the extension and to ensure interoperability among implementations.",
"authors": [
"V. Dukhovni",
"S. Huque",
"W. Toorop",
"P. Wouters",
"M. Shore"
],
"organizations": [],
"publication_date": "2021-08-01",
"current_status": "EXPERIMENTAL",
"current_status_ru": "Экспериментальный",
"publication_status": "EXPERIMENTAL",
"publication_status_ru": "Экспериментальный",
"lifecycle": "experimental",
"lifecycle_ru": "Экспериментальный",
"stream": "INDEPENDENT",
"stream_ru": "Независимый поток",
"area": "",
"area_ru": "",
"working_group": "",
"source_draft": "draft-dukhovni-tls-dnssec-chain-08",
"page_count": 43,
"doi": "10.17487/RFC9102",
"keywords": [],
"formats": [
"HTML",
"TXT",
"PDF",
"XML"
],
"relations": {
"obsoletes": [],
"obsoleted_by": [],
"updates": [],
"updated_by": [],
"is_also": [],
"see_also": []
},
"links": {
"info": "https://www.rfc-editor.org/info/rfc9102/",
"html": "https://www.rfc-editor.org/rfc/rfc9102.html",
"txt": "https://www.rfc-editor.org/rfc/rfc9102.txt",
"datatracker": "https://datatracker.ietf.org/doc/rfc9102/"
}
}