Support more features from Kaminsky

os3sec / Extended-DNSSEC-Validator

Firefox add-on for verification of x509 certificates using DNSSEC as bootstrap mechanism

http://os3sec.org

15 stars 9 forks source link

Closed plange closed 13 years ago

plange commented 13 years ago

We haven't implemented Dan Kaminsky's full TXT spec (http://dankaminsky.com) from his reference "Phreebird" implementation.

We still have to support:

livehashing (take hash of certificate and lookup corresponding valid DNSSEC record)
hash range (take hash of certificate or of public key contained in certificate)

dannygroenewegen commented 13 years ago

Removed support for this. We need one 1 standard: TLSA records