Re: [dnsext] New RRTYPE assignment request: SSLFP RRTYPE Request

[Edward Lewis <[e-mail]>]

So, it's like this?

hostname.example.tld.            AAAA  2003:82BF:9E21::CAFE:BEEF
_http._tcp.hostname.example.tld. TLSFP 80 0 5 1 F6CD025B3F5D03040895 (
                                                 05354A0115584B56D683 )
_http._tcp.hostname.example.tld. TLSFP 80 0 5 1 584B56D683F6CD025B3F (
                                                 5D0304089505354A0115 )
_ssh._tcp.hostname.example.tld.  TLSFP 22 1 2 1 123456789abcdef67890 )
                                                 123456789abcdef67890 (
(latter instead of)
_ssh._tcp.hostname.example.tld.  SSHFP 2 1 123456789abcdef67890 )
                                            123456789abcdef67890 (

Positioning this as an improvement on the SRV record is certainly 
more promising that this old proposal to extend the KEY RR 
(http://www.potaroo.net/ietf/all-ids/draft-lewis-dnsext-key-genprot-00.txt). 
I mention the latter because it was part of the SYKED BOF, which 
tried to organize the three proposals to put application keys into 
the DNS - the SSH proposal which did make it to an RFC, a proposal 
for IPSEC which also went to RFC were the other two.  The KEY RR 
generic was dropped.

The "con" to the idea was the thought of putting too much emphasis on 
the security of DNSSEC, i.e., if the DNS key was mangled, other 
protocols could then be mangled.  I don't know if I really buy that 
argument, but it was the big hit SYKED took from the Security Area. 
But SSH and IPSECKEY (the WG name) got specific key proposals through.

I think it's a good idea, I think the discussion is over the security 
models of the applications and how much fate sharing they can take 
with DNSSEC.

At 16:00 -0400 4/13/09, Andrew Sullivan wrote:
>Dear colleagues,
>
>I hereby post the attached template for public review, under the terms
>of RFC 5395.  This posting begins the formal comment period under
>section 3.1.1 (1) in RFC 5395.
>
>Due to the unavailability of others, I'll be the expert performing
>this review.
>
>Please provide any comments you have on the proposal by 17:00 EDT on
>2009-05-04.  I may not be able to consider comments received after
>that time.
>
>Best regards,
>
>Andrew
>
>--
>Andrew Sullivan
>[e-mail]
>Shinkuro, Inc.
>
>Attachment converted: Macintosh HD:sslfp-rr-request.txt (TEXT/ttxt) (00348806)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at [phone]

Getting everything you want is easy if you don't want much.