Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secure HIP-2 address resolution #524

Merged
merged 1 commit into from
Jun 29, 2022

Conversation

rithvikvibhu
Copy link
Collaborator

Closes #496.

There's a race condition in verifying DANE and fetching addresses with HIP-2. I don't think it's possible to create a DANE HTTP Agent that works with nodejs and validates certificates and TLSA. So this PR replaces verifies cert at the end of the HTTPs request.
It replaces the hip2-dane package with code in background/hip2/.

Test cases:

Try different domains on the Send page:
@falci.me - should work
@iamfernando - should NOT work (expired RRSIGs)
@hip2.bb-8 - should work
@nathan.woodburn - should work

@Falci
Copy link
Contributor

Falci commented Jun 27, 2022

ACK 2908eae

Signature
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ACK 2908eae6442593b238fbbce3c3144e894b24ef1f
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEES8727kxPR/Rz8Cubq3h7gz2QNh0FAmK59pIACgkQq3h7gz2Q
Nh1CNBAAgF51chb+3BngFFn7k/QWjJS/Z7Mu4ZWpFUDOQ3XTAWfX5nliEjaEfUs2
k/jTHdQImOsHvPRQt7w3zXsrnqM1Vd5ibNGg3NCV8e/JFTp92Tbt9N71hYKlzXbN
Cyb/USDnKcylwdq2TmDcmGOYNq362aXdlFPIephi3FP5R0g89yB0mwiMXCC/N98Z
7J5la/HrhvO+H0MiqmC0yvX2tXhz+s5H+Tuf0BoegH3qWrumwH1mB9i6PW1a8edx
s8/4BfzAmyAe+hcak1DTDv8W0MJbGa3Noy3moPTbSfaV+ljuPWmR0P5BKOAFAVm8
4FyJQTd1cOA271pCZcI58goCVGYx9+T5aIYvrVJEgg/ioHZ9Ixm+MQV+DlHRMPJk
xtFU0KCajPBeLSXl0hUbhGS5mfow9365kuF38qkAfLKX2oS+ydy18bD3qjxK866k
76Htw3YNXSfpO5b8l6ePZl8FX7tBPkuhbOpmfmXzDJGeAUSsbm6JVL85VA5hMwKw
UQKqNczRtHQaqxEsOijjV4CrH0hhzsI9VT/vvzVfrEcbwcq0eX9/ezrr8U4LJwOk
SZx+Yysw2eZiQghAdAJcR9Sv2PS7cLjwX4CAM4bf32V4Z9qtV6k6Fi7RUeiBOkA/
eAREFXitnvF5iYnpswAvCX4RcOO2dzDBSU3nsza5VQHY0EWiVK0=
=Du+D
-----END PGP SIGNATURE-----

falci's public key is on keybase

image

image

image

image

image

@rithvikvibhu rithvikvibhu merged commit 6ac75bb into kyokan:master Jun 29, 2022
@rithvikvibhu rithvikvibhu deleted the hip2-secure branch June 29, 2022 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

HIP2 can be used with insecure domains
2 participants