[dnsext] DTLS alternative to DNS-Curve

[Phillip Hallam-Baker <[e-mail]>]

While I like the architectural approach of DNS-Curve for certain
applications, the realization is really not very sensitive to the existing
DNSSEC infrastructure. There is a lot of new protocol, a lot of new code to
write and test.

The specific field of interest to me is securing the connection between a
DNS client and a DNS resolver. In the traditional model the DNS resolver has
a trusted role but the connection between the client and resolver has
neither confidentiality nor integrity protections. In a secure environment I
want both.


TSIG is much closer to what I want. All I really want is either TSIG plus a
key exchange mechanism or TSIG plus confidentiality plus a key exchange
mechanism.

Any mechanism we use has to be capable of operating without server side
connection state. It is also helpful if the mechanism allows a limited form
of packet aggregation in case the added crypto data causes the responses to
exceed the MTU.

TLS already has a suitable key agreement mechanism and has a means of
establishing a ticket that contains the server side state. Reusing this
mechanism avoids the need to write any additional code in most cases since
most DNSSEC implementations are built on OpenSSL or on a platform like
Windows that includes a full SSL stack.


One option is to build a two phase scheme in which the key negotiation is
performed in one phase using TLS to a HTTPS server to establish a ticket.
That ticket can then be used to support a secure wrapper for the DNS request
and response.

Another option is to use DTLS. That might simplify coding further still when
using a library that already has DTLS. The downside is that we would not be
able to optimize the scheme to DNS and the result would be much more complex
in cases where DTLS is not already supported since we are only using a small
subset of that spec.


I don't have a concrete proposal of this type to make at the present time.
But if people are interested in this approach and want to work together on a
proposal, could they drop me a line?

-- 
Website: http://hallambaker.com/