Re: [dnsext] Advice sought on DNS file format for new RRs

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Nov 19, 2010 at 5:34 PM, Olafur Gudmundsson <[e-mail]> wrote:

> On 19/11/2010 4:50 PM, Phillip Hallam-Baker wrote:
>
>> Thanks,
>>
>> The records are independent of each other, Each record specifies one
>> Authorization Entry and the set of RRs make up an Authorization Set
>> similar to an ACL but a set not a list.
>>
>> We did have a concern raised for the possibility that a RR set would
>> become fragmented and a relying party might only get some of the
>> records. In other words there are 5 CAA records in a domain and the
>> resolver only caches 3. Would this really be an issue? I would have
>> thought not since signatures are over the full RR set.
>>
>>
> Impossible, DNS caches store either all or none.


That was my belief, but I wanted to check.



> What I am trying to do at this stage is to work out what the range of
>> options is here. I see the following choices:
>>
>> 1) Binary encoding with potentially different data types depending on
>> the sub tag.
>>
>> CAA   policy <oid> | path <base64> | critical <string>
>>
>> 2) Binary encoding with a uniform data structure like in the CERT tag:
>>
>> CAA <tag> <critical flag> <base64>
>>
>> 3) TXT style encoding in the manner of DKIM
>>
>> CAA <tag> <TXT data>
>>
>>
>>
> You are still confusing DNS wire format and DNS presentation format.
>

No I understand the difference.

The constraint here is that if I have a complex binary format, then DNS
servers are going to have to be able to parse a correspondingly complex
syntax to encode the data. That may not be desirable.


Wire format is always binary i.e. all base64 blocks are translated to
> 8bit binary, Text blocks are translated to a special text format, etc.
>

That is not the case in DKIM.

In DKIM the key blobs are encoded in base64 and that is how the data is
stored in the DNS TXT record.



> Format 1 is fine if the records are dependent on each other (i.e. atomic),
> If the records are independent subsets you should use different types. Every
> time DNS has started using sup-typing we have run into problems.
>

The TXT approach appears to work in DKIM because the records in question do
not affect the operation of DNS itself.


-- 
Website: http://hallambaker.com/