Re: [dnsext] New RRtype "KREALM" in draft-vanrein-dnstxt-krb1-02.txt

[Rick van Rein <[e-mail]>]

   DNS RRTYPE PARAMETER ALLOCATION REQUEST

   A. Submission Date: September 11, 2015.

   B.1 Submission Type:  [X] New RRTYPE  [ ] Modification to RRTYPE
   B.2 Kind of RR:  [X] Data RR  [ ] Meta-RR

   C. Contact Information for submitter (will be publicly posted):
      Name: Rick van Rein              Email Address: [e-mail]
      International telephone number: +31.53.4782239
      Other contact handles: Haarlebrink 5, 7544 WP  Enschede, The
Netherlands

   D. Motivation for the new RRTYPE application.

      Kerberos lacks a mechanism to find a realm name for a given domain
name
      or host name.  This was never defined due to insecurity of DNS.  With
      DNSSEC broadly deployed, we can now safely lookup realm
descriptions for
      DNS names, and this RRtype captures such realm descriptions.  The new
      facility can help to realise new Kerberos use cases such as
Internet-wide
      realm crossover.

   E. Description of the proposed RR type.

      https://tools.ietf.org/html/draft-vanrein-dnstxt-krb1

   F. What existing RRTYPE or RRTYPEs come closest to filling that need
      and why are they unsatisfactory?

      TXT might have worked, but would require "educated guessing" on the
      semantics (not ideal from a security perspective) and is advised
      against by DNS experts; a new RRtype was suggested in its place.

   G. What mnemonic is requested for the new RRTYPE (optional)?

      KREALM (short for Kerberos Realm Descriptor)

   H. Does the requested RRTYPE make use of any existing IANA registry
      or require the creation of a new IANA subregistry in DNS
      Parameters?  If so, please indicate which registry is to be used
      or created.  If a new subregistry is needed, specify the
      allocation policy for it and its initial contents.  Also include
      what the modification procedures will be.

      From the 04 version of the I-D we quote:

       This specification defines a new "Resource Record (RR) Type", to be
       registered in the IANA registry of Domain Name System (DNS)
       Parameters".  The name of the RRType is KREALM, its value is TBD1 and
       its meaning is "Kerberos Realm Descriptor".

       This specification establishes a new registry with IANA, whose
       entries are subject to expert review and whose definition must be
       described in a publicly available specification.  The new registry
       will be known as the "Kerberos Realm Descriptor Tag Registry".  Each
       entry must provide a Yes/No flag to indicate if the tag is a Home
       Tag, meaning that it may only be interpreted as part of Home Records.

       The initial entries for this new registry introduced by this
       specification are:

                    +----------+-----------+-----------------+
                    | Tag name | Home Tag? | Definition      |
                    +----------+-----------+-----------------+
                    | realm    | No        | [TBD:THIS-SPEC] |
                    | service  | No        | [TBD:THIS-SPEC] |
                    | admin    | Yes       | [TBD:THIS-SPEC] |
                    +----------+-----------+-----------------+

       Tag names are case-sensitive.  Registration of new tags is subject to
       expert review, and a specification must be created as part of its
       definition.

       DISCUSS: Suggestions on the submission process for new tags are
       requested.

       In addition to the foregoing, tag names starting with "x-" are
       reserved for local and experimental use, for which registration is
       neither possible nor required.  These unregistered tags will not be
       protected from name clashes.

   I. Does the proposal require/expect any changes in DNS
      servers/resolvers that prevent the new type from being processed
      as an unknown RRTYPE (see [RFC3597])?

      No, the unknown RRTYPE from RFC3597 can handle KREALM.

   J. Comments:

      The I-D for this RRtype has been proposed on the DNSEXT list and
      suggestions for improvement were supplied by Mark Andrews on Sep
4, 2015.
      These suggestions have all been incorporated into version 03 and
shared
      back with Mark and the DNSEXT list on Sep 6, 2015.  There have been no
      further comments on the proposal.

      New RRtype "KREALM" in draft-vanrein-dnstxt-krb1-02.txt