Re: [core] DNS-SD service types for CoRE-RD (Re: AD review of draft-ietf-core-resource-directory-23)

[Christian Amsüss <[e-mail]>]

Hello group,
hello Carsten,

On Mon, Dec 09, 2019 at 09:34:29PM +0100, Carsten Bormann wrote:
> In the meeting, I gave the three examples _core-rd._udp,
> _core-rd-tls._udp, and _core-rd._tcp — noting that while core-rd is a
> proper RD service type, core-rd-tls isn’t.  To cover the six
> transports we have for CoAP today (coap, coaps, coap+tcp, coaps+tcp,
> coap+ws, coaps+ws), we would need four service types on top of _tcp
> and could use two of them over _udp?

Do we have a meaningful way to deal with (D)TLS in DNS-SD at all? I'm
only superficially familiar with the verification steps done on the host
name, but as I understand, TLS typically authenticates the host name.

If the client is configured to register at any RD in the current domain,
it'd receive a

_core-rd-dtls._udp.example.com IN SRV 1 1 5683 rd1.example.com

When it connects, the server would present a certificate for
rd1.example.com without any indication that it's a legitimate
_core-rd-dtls._udp.example.com.

Is there a document that bridges that gap in a usable manner that we can
point to for security considerations? Otherwise I'd rather leave the
TLSs out of here. (Alternatively, we could describe them as opportunistic
encryption.)

Kind regards
Christian

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom