[dispatch] New Draft: DNS-based out-of-band integrity verification (DIVE) for HTTP resources

[Matéo Callec <[e-mail]>]

Hi all,



I'd like to bring an updated draft to DISPATCH and get your guidance on next steps. This work was previously discussed in SECDISPATCH and on DNSOP.



Domain-based Integrity Verification Enforcement (DIVE) is a mechanism for verifying the integrity and authenticity of static HTTP artifacts (firmware images, packages, versioned binaries) by publishing signing keys as DNSSEC-protected DNS records. The target use case is non-browser, automated clients (update agents, package managers, IoT fleets) where offline-signed content and DNS-based key revocation can replace a CA-based code-signing setup.



Draft: https://datatracker.ietf.org/doc/draft-callec-dive/ 

Previous SECDISPATCH thread: https://mailarchive.ietf.org/arch/msg/secdispatch/zLaSbwVyMLvpMU5B0dwjXEPA9-Q/ 

IETF 126 HotRFC slides: https://datatracker.ietf.org/meeting/126/materials/slides-126-hotrfc-sessa-dive-a-dns-based-alternative-to-ca-based-code-signing-for-http-artifacts-00 



Version -02 addresses the feedback received on the earlier versions. Given the narrow, specific-use-case scope of this work, I'd appreciate the group's view on whether this fits an existing WG, would be better handled as an AD-sponsored individual submission, or needs something else.



Thanks,

Matéo