[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #33568 [Applications/Tor Browser]: Namecoin for TLS certificate validation
#33568: Namecoin for TLS certificate validation
-------------------------+------------------------------------------
Reporter: JeremyRand | Owner: tbb-team
Type: enhancement | Status: new
Priority: Medium | Component: Applications/Tor Browser
Version: | Severity: Normal
Keywords: namecoin | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------+------------------------------------------
Namecoin can provide DANE-style functionality for TLS certificate
validation. This would enable validating trust of TLS certificates for
onion services that have a Namecoin domain (relevant for Whonix-style
trust models) without relying on public CA's, and would also make it
harder for MITM attacks against exit traffic to be performed (if Namecoin
support for exit traffic were added to Tor Browser).
Firefox does not natively support DANE, but we (the Namecoin devs) have
identified a way to get DANE-like functionality in Firefox with no code
patches to Firefox (we're using the PKCS11 "FindObjects" API to achieve
this). Some small code patches to Firefox would make the code cleaner,
but this wouldn't be required.
I assume this is a lower priority than the existing Namecoin support for
onion services that's currently in Tor Browser Nightly, but Matt asked me
to file a ticket for it anyway since it came up in one of the Tor Browser
IRC meetings.
(As a side note, Namecoin's approach for getting DANE-like functionality
in Firefox would probably be equally workable for the .onion TLD, so this
might also allow things like putting a TLSA record in an onion service
descriptor, without relying on Namecoin itself at all.)
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33568>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs