Date: Mon, 21 Sep 2026 20:00:01 +0200
From: =?UTF-8?Q?Mat=C3=A9o_Callec?= <mateo@callec.net>
To: "dispatch" <dispatch@ietf.org>
Message-Id: <1a0ba24d2c8.3845f1ee808992.7396320873988810433@callec.net>
In-Reply-To: 
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_2542390_977317994.1789829370568"
Importance: Medium
User-Agent: Zoho Mail
Message-ID-Hash: X2S4VA6TYDLEFG3U4VFY2Q2LAHJDPHBT
Precedence: list
Subject: [dispatch] New Draft: DNS-based out-of-band integrity verification (DIVE) for
 HTTP resources
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dispatch/EQeG82FSuCC5rNOvs9apSQIfIPU>

------=_Part_2542390_977317994.1789829370568
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi all,


I'd like to bring an updated draft to DISPATCH and get your guidance on nex=
t steps. This work was previously discussed in SECDISPATCH and on DNSOP.


Domain-based Integrity Verification Enforcement (DIVE) is a mechanism for v=
erifying the integrity and authenticity of static HTTP artifacts (firmware =
images, packages, versioned binaries) by publishing signing keys as DNSSEC-=
protected DNS records. The target use case is non-browser, automated client=
s (update agents, package managers, IoT fleets) where offline-signed conten=
t and DNS-based key revocation can replace a CA-based code-signing setup.


Draft: https://datatracker.ietf.org/doc/draft-callec-dive/=20

Previous SECDISPATCH thread: https://mailarchive.ietf.org/arch/msg/secdispa=
tch/zLaSbwVyMLvpMU5B0dwjXEPA9-Q/=20

IETF 126 HotRFC slides: https://datatracker.ietf.org/meeting/126/materials/=
slides-126-hotrfc-sessa-dive-a-dns-based-alternative-to-ca-based-code-signi=
ng-for-http-artifacts-00=20


Version -02 addresses the feedback received on the earlier versions. Given =
the narrow, specific-use-case scope of this work, I'd appreciate the group'=
s view on whether this fits an existing WG, would be better handled as an A=
D-sponsored individual submission, or needs something else.


Thanks,

Mat=C3=A9o
------=_Part_2542390_977317994.1789829370568
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>=
<meta content=3D"text/html;charset=3DUTF-8" http-equiv=3D"Content-Type"></h=
ead><body ><div style=3D"font-family: Verdana, Arial, Helvetica, sans-serif=
; font-size: 10pt;"><div>Hi all,<br></div><div><br></div><div>I'd like to b=
ring an updated draft to DISPATCH and get your guidance on next steps. This=
 work was previously discussed in SECDISPATCH and on DNSOP.<br></div><div><=
br></div><div>Domain-based Integrity Verification Enforcement (DIVE) is a m=
echanism for verifying the integrity and authenticity of static HTTP artifa=
cts (firmware images, packages, versioned binaries) by publishing signing k=
eys as DNSSEC-protected DNS records. The target use case is non-browser, au=
tomated clients (update agents, package managers, IoT fleets) where offline=
-signed content and DNS-based key revocation can replace a CA-based code-si=
gning setup.<br></div><div><br></div><div>Draft: <a target=3D"_blank" href=
=3D"https://datatracker.ietf.org/doc/draft-callec-dive/">https://datatracke=
r.ietf.org/doc/draft-callec-dive/</a><br></div><div>Previous SECDISPATCH th=
read: <a target=3D"_blank" href=3D"https://mailarchive.ietf.org/arch/msg/se=
cdispatch/zLaSbwVyMLvpMU5B0dwjXEPA9-Q/">https://mailarchive.ietf.org/arch/m=
sg/secdispatch/zLaSbwVyMLvpMU5B0dwjXEPA9-Q/</a><br></div><div>IETF 126 HotR=
FC slides: <a target=3D"_blank" href=3D"https://datatracker.ietf.org/meetin=
g/126/materials/slides-126-hotrfc-sessa-dive-a-dns-based-alternative-to-ca-=
based-code-signing-for-http-artifacts-00">https://datatracker.ietf.org/meet=
ing/126/materials/slides-126-hotrfc-sessa-dive-a-dns-based-alternative-to-c=
a-based-code-signing-for-http-artifacts-00</a><br></div><div><br></div><div=
>Version -02 addresses the feedback received on the earlier versions. Given=
 the narrow, specific-use-case scope of this work, I'd appreciate the group=
's view on whether this fits an existing WG, would be better handled as an =
AD-sponsored individual submission, or needs something else.<br></div><div>=
<br></div><div>Thanks,<br></div><div>Mat=C3=A9o<br></div><div><br></div></d=
iv><br></body></html>
------=_Part_2542390_977317994.1789829370568--