互联网工程任务组ietfr barnesrfc6394 txt.pdfVIP

InternetEngineeringTaskForce(IETF)R.Barnes

RequestforComments:6394BBNTechnologies

Category:InformationalOctober2011

ISSN:2070-1721

UseCasesandRequirementsforDNS-BasedAuthentication

ofNamedEntities(DANE)

Manycurrentapplicationsusethecertificate-basedauthentication

featuresinTransportLayerSecurity(TLS)toallowclientstoverify

thataconnectedserverproperlyrepresentsadesireddomainname.

Typically,thisauthenticationhasbeenbasedonPKIXcertificate

chainsrootedinwell-knowncertificateauthorities(CAs),but

additionalinformationcanbeprovidedviatheDNSitself.This

documentdescribesasetofusecasesinwhichtheDNSandDNS

SecurityExtensions(DNSSEC)couldbeusedtomakeassertionsthat

supporttheTLSauthenticationprocess.Themainfocusofthis

documentisTLSserverauthentication,butitalsocoversTLSclient

authenticationforapplicationswhereTLSclientsareidentifiedby

domainnames.

StatusofThisMemo

ThisdocumentisnotanInternetStandardsTrackspecification;itis

publishedforinformationalpurposes.

ThisdocumentisaproductoftheInternetEngineeringTaskForce

(IETF).ItrepresentstheconsensusoftheIETFcommunity.Ithas

receivedpublicreviewandhasbeenapprovedforpublicationbythe

InternetEngineeringSteeringGroup(IESG).Notalldocuments

approvedbytheIESGareacandidateforanylevelofInternet

Standard;seeSection2ofRFC5741.

Informationaboutthecurrentstatusofthisdocument,anyerrata,

andhowtoprovidefeedbackonitmaybeobtainedat

.

BarnesInformational[Page1]

RFC6394DANEUseCasesOctober2011

Copy