Re: [dnsext] Draft: RRTYPE B - Web Resource Integrity

[James Addison <[e-mail]>]

On Thu, Nov 16, 2023 at 8:15 AM Niall O'Reilly <[e-mail]> wrote:
>
> On 14 Nov 2023, at 17:36, James Addison wrote:
>
> > The proposal here is to add a DNS B record type, to be used to publish
> > integrity metadata for the root index URI of a website on a given
> > domain record.
>
> I wonder whether the existing HTTPS RR (RFC 9460), with an additional
> SvcParam definition, wouldn't satisfy the use case.  If not, I suggest
> mentioning it, and the reasons for its unsuitability, in making the case
> for the proposed B RR.

Thank you Niall - yes, from a read of RFC 9460, it does seem like a
SvcParamKey could be a good way to handle this use case, that's
helpful.  I've taken a look at the IANA registry of existing service
bindings[1] to confirm that no such binding has been added so far.

Note: there is one potential conflict from this use case that I'm
aware of -- this use case is intended to cover both plaintext HTTP and
encrypted HTTPS web requests.  Section 9.5 of RFC 9460 as I interpret
it so far seems to require that the client upgrade to TLS/HTTPS for
web requests.

In any case: I'll do some more reading and will contact the authors.

> HTTPS and SVCB RR types are already supported in a number of DNS codes,
> and I understand that browsers (in order to support Encrypted Client Hello)
> will include this support shortly.  Building on this existing work may
> be advantageous.

+1

[1] - https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml#dns-svcparamkeys