Kurer andDANEportal.net
Minar Islam - tislam20@gmu.edu
Pavan Kumar Dinesh - pdinesh@gmu.edu
Josh Yuen - jyuen2@gmu.edu
Tomofumi Okubo - tomofumi.okubo@digicert.com
Eric Osterweil - eoster@gmu.edu
Support from Commonwealth Cyber Initiative (CCI)

Making DANE easy
Using DANE protocols to power S/MIME

1

DANE is a powerful protocol suite:● It makes doing security and privacy easier● But what can we do to make DANE easier?

2

For the everyday person●Why can’t people to simply “turn on” secure messaging on the Internet?
○ Platform limitations○ Organizational boundaries○ Usability concerns○ … Anything else?

We are launching basic research into how DANE can unlock long-needed protections● mHealth, Smart and Connected Cities, CTI sharing, 5G/NextG and much more

3
Images: flaticon.com

For the everyday person●

Why can’t people to simply “turn on” secure messaging on the Internet?
○ Platform limitations○ Organizational boundaries○ Usability concerns○ … Anything else?

We are launching basic research into how DANE can unlock long-needed protections● mHealth, Smart and Connected Cities, CTI sharing, 5G/NextG and much more
… it starts with core internet protocols which everyone uses: email-To ﬁnd out exactly what people need to make end-to-end Internet security
seamless and turned on everywhere: make it invisible

4Images: flaticon.com

We need usable tools out there!
“Make it easy”: secure email with DANE●

Setting up DANE needs work from domain holders / zone admins●Using certs from DANE needs integration with users’ mail clients5

We need usable tools out there!
“Make it easy”: secure email with DANE●

Setting up DANE needs work from domain holders■●

Cert management portal DANEportal.net

Using certs from DANE needs integration with users’ mail clients6We need usable tools out there!
“Make it easy”: secure email with DANE●

Setting up DANE needs work from domain holders■●

Cert management portal DANEportal.net

Using certs from DANE needs integration with users’ mail clients○

MUA add-on Kurer
7

We need usable tools out there!
“Make it easy”: secure email with DANE
●Setting up DANE needs work from domain holders■●Cert management portal DANEportal.net

Using certs from DANE needs integration with users’ mail clients○MUA add-on Kurer… and ﬁnd out what people need to make E2E security a default

8

We know one thing for sure:●E2E needs key management, and cert discovery

And if our ambitions are Internet-scale:

DANE is an excellent answer — and we made just the tool to make it easy9Making DANE easy:
daneportal.net●An open-source federated cert management portal and dedicatedDNS infrastructure to make DANE easy○

Domain holders enable DANE for their DNSSEC-signed zone○

Email users manage their certs for their email addresses

10Make a new user●

Let’s see how a new
domain holder would
enable DANE

11

Dashboard: claim a zone●

Users can see the dane zones
and email addresses
managed under their portaldashboard●

Domain holders canenable DANE for theirzone by ﬁrst claiming it

12Dashboard: claim a zone●

Anyone can add a zone claim
to their dashboard

13

Dashboard: claim a zone●

But to actually create theDANE zone and admin it they
will need to verify their claim

14Dashboard: verify a claim

To prove ownership andverify, the user will needto add a TXT recordand have the zone
DNSSEC enabled

15

Dashboard: verify a claim

Any DNS provider will
work as long as they
allow those16

Let’s see a real delegation
Once veriﬁed, daneportal will
create the DANE zone for you

17

Zone management: delegation
Once veriﬁed, daneportal will
create the DANE zone for you
Just complete the delegation
to hook it up

18

Zone management: delegation

19

Zone management: active
As admin you hold all thekeys: daneportal will only
serve the DANE zone when
you set it active

20

Zone management: activeYour DANE zone is now
live with DNSSEC
Conﬁrm it checks out:
secspider.net

https://secspider.net/chain-of-trust.cgi?z=_smimecert.aonova.net.

21

Zone management: add new email

Add an email address toallow cert management forthat entity on daneportal
22

Zone management: add new email

23

Zone management: add new email

24

Dashboard: email user
Now lets see how that newly addedemail user can manage their certs
on DANE under your zone25

Email data: add new cert26

Email data: add new cert27

Email data: create a new cert28

Email data: create a new cert29

Email data: create a new cert30

Email data: conﬁgure and activate

31

Email data: conﬁgure and activate

32

Making DANE easy:●Admin: allow domain holders to enable DANE
○
○
○
○

●

Email user: allow federated certiﬁcate management○○○●●Create an account
Claim and verify their zone
Hook up the DANE zone by DNS delegation
Add email addresses / users under their zone

Access their email address under the portal
Create/add certiﬁcates under their address on DANEManage the state of their certs

Check out the dets: https://daneportal.net/docs
Give us feedback: contact@daneportal.net
33

We saw the ﬁrst half:●

Setting up DANE easily■

Cert management portal DANEportal.net

34

We saw the ﬁrst half:●

Setting up DANE easily■

Cert management portal DANEportal.net

Now for the other half:●Using certs from DANE needs integration with users’ mail clients○

MUA add-on Kurer… to ﬁnd out what people need to make E2E security a default

35

Invisible Security●

We don’t have wide-scale E2E email security deployed on the Internet●

By observing our tools in action we can ﬁnd out what makes sense if weare to make E2E a default●

To that end we instrumented our next tool as a live experiment○

Where you can help us to get some real numbers on the human puzzle
piece in security automation

36

Let’s show just how easy it is●With Kurer on the popular email client of your choice37

Hooking it up
You just need to add yourprivate key in the settings●

Enable signing anddecrypting38

Hooking it up
You just need to add yourprivate key in the settings●

Enable signing anddecrypting

39

Hooking it up
You just need to add yourprivate key in the settings40

Hooking it up
You just need to add yourprivate key in the settings

41

Now jump into a secure email convo with a stranger

42Compose as normal

43

Decide to sign/encrypt44One click secure send

45

Read it on the other end46

Quick security details

47

Easily start reply

48Reply as normal

49

Secure send reply

50

Read the reply

51

Seamless secure convo

52

Kurer: details●

Secure messages sent as attachments (standard PKCS7 S/MIME)●DANE cert resolution handled silently and directly○Does not step on client keystore○

Can honor DANE cert Usage (even without PKIX)

53

Kurer: details
Live right now (https://kurer.daneportal.net) and open source○

For Outlook - Exchange synchronized add-on○

And Thunderbird - Standard .xpi package○

Standard installation ﬂows

It’s not just a convenient tool:●

Vital part of our research to discover what people need and expect
to make E2E security a default at scale54

What do people need?
We saw how people conﬁgure their keys, but what othersettings to people need?
●We’ve condensed to a set of usable settings○●

with (what we believe to be) sane defaults

What should be silent vs explicit?

55

What do people need?
We saw how people conﬁgure their keys, but what othersettings to people need?
●We’ve condensed to a set of usable settings○●with (what we believe to be) sane defaults

We can learn from what they choose56

Invisible Security: how?
●Kurer lets users opt-in to an anonymous userstudy○

IRB approved

This is where you can help us to see
what the shape of needed security is57

Invisible Security: nitty gritty●

When accepted, certain settings toggles will
be securely shared with our telemetry server○

Also, DoH resolver conﬁgured will be shared(if it is on the list of known public servers)

58

Invisible Security: nitty gritty●

Users can optionally answer basic
demographic queries

59

Invisible Security: nitty gritty●

Does not invade your privacy:○

Telemetry is only shared when clicking “save” on thesettings page after opting-in the user study○

We never track or care about your emails,
only noting the set default conﬁgs

60

Invisible Security: nitty gritty●

You have the right to be forgotten○

Users can toggle off their participation at any time○

On top of sent data being anonymous,users can also request all the data ever sent fromtheir current install to be purged61

We can’t do it alone
We would greatly value your participation!

●Help us produce the results that show whatpeople need, to automate and enable invisible
security on the Internet

62

Big picture●

DANE as an architecture lets us make E2E security more seamless for the everyday
person on the Internet●

In the past the IETF made a push for “HTTPS everywhere” and we now live in a world where Internet-scale transport security is the default○●We believe that sort of ubiquity should be the case for E2E: Internet-scale Object Security

We start with tools for email security — but this is the proving grounds○

Try them out, and help us to see what users need○

Further our research on using DANE advance CTI, mHealth, SCC, etc, to be what users actually need63

Thank you64