[DNSOP] Request for feedback on draft-midwestcyber-dspip (DNS-based key distribution for physical item authentication)
Andy Boell <andy@midwestcyber.net> Mon, 25 May 2026 03:24 UTC
Return-Path: <andy@midwestcyber.net>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 20292F46CEB3 for <dnsop@mail2.ietf.org>; Sun, 24 May 2026 20:24:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1779679474; bh=+cRMj8d17cEEtHsDrh4St1myJiznMNMnzlek9YzmtB4=; h=From:To:Subject:Date; b=pfzNBN4Nrl53i0NHi8YRsWdGWzHlJwf+5PXN5L+zcOguHc8vjg4hclE1lkI68wGQK wZsfPbh++Vn5TvskIOpZAkqbeI+926aBM6m9f4a1Q+3qHAHd0IiJHTa57LDDSES18C QmpZatWM8YgPUWolBKIP6JABZXTXKiT9JtFmwnSM=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.086
X-Spam-Level:
X-Spam-Status: No, score=-2.086 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=midwestcyber.net
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AJY9zPwragcx for <dnsop@mail2.ietf.org>; Sun, 24 May 2026 20:24:33 -0700 (PDT)
Received: from BN1PR04CU002.outbound.protection.outlook.com (mail-eastus2azon11020121.outbound.protection.outlook.com [52.101.56.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 5E23CF46CEA9 for <dnsop@ietf.org>; Sun, 24 May 2026 20:24:33 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=v2XLgDd5tSeLe8KolRhrgYJJXcLp6mKT/Fg56STiwPqf4yNTt3VNdZRVrVkD6own2hBsJaogdeCmbKgxF+qU/FrZ6pMNZBPXmLic7lcfS8aRIctO7KljoE0a6euX9Hj51e51Qeqsd4+B0CgQwIW+CVkt/BK13dbMBe3t66q7K+GwuJyaaVcQthELt+J2xkwyPkVuprnXbNLLdzCWTap8YtXwgUZvSvFOBZWt6yJoIMwg5fETzlXeeE5eLY/76OlpfG/B0sJM0EjB7vJcm8y4kRKEmkU6rZZFrYcVbAsvmIcbcUOse9wum9cX4aL0D0esow965KUO5rNTSrD92mgtew==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+SD1X5nSDzhgBtALtu/stR0OHpsn6tzGyHBnkd8GxqQ=; b=kuKZbXOUB76f2uLwm8VA67rL/jMOYJ/LPHvD44fkQXotdy4wqkIYYJiBSw5SVeYA+oyIkNrBJ6bwPUHl0fqzpmHfjrU5F6EVJC/M6IYncoUBDXg6cE1JKLZNrAVZy1r9Q8pl6kFqfvDArf7moUbXjHT8ewNeCcRFybh9gz6GYqYx0mlxx6Jrk1cGYksTfe0AcOemUgClrHIo1sLrfdRRRPRcdBs8fzJ+2F2hYlJQhIJbQMcJrbzAlz5QsxYqpAy1FlNTFSlumaqDipF1XGyU1pGYbGK1V8f+FCxIc9vVKj+0+OhMKj1XPomGlyD9ButRMD12JvYMUiau75eib7ynsQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=midwestcyber.net; dmarc=pass action=none header.from=midwestcyber.net; dkim=pass header.d=midwestcyber.net; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=midwestcyber.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+SD1X5nSDzhgBtALtu/stR0OHpsn6tzGyHBnkd8GxqQ=; b=drokrELoPikWtTAsvBfqkSoJX1w5Zs1/4WYslXHYP940KtxT0U3z1/xRioS0nSqP/LZyKnBkBnTk4SqU5/Ip8aCI0geujcIJVQG7Ru/9IQ7v3SOzUTDo23gexZWVWeHVxpXlVavN/erUWAgq9LUzVY2rYSFH/kFK8z7vM/agGk/iRosZabsVfKkgR+C7ax+USya9CXLrlp0IKdn+0dL0s8L7ZjTrXFOEg7cl0O+XW79wUCwS5FyFxYU1+yOf6lM1fB/6XH5QdLqmdJxVAsH7RFJC97LUQ49IU8XxRteeIAIWtfzLYbfCh1hi0rEcAZiWsf+20vSUTKZ5TD6b20tHvg==
Received: from MN2PR17MB2958.namprd17.prod.outlook.com (2603:10b6:208:e4::27) by LV0PR17MB7571.namprd17.prod.outlook.com (2603:10b6:408:33e::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.25.19; Mon, 25 May 2026 03:24:24 +0000
Received: from MN2PR17MB2958.namprd17.prod.outlook.com ([fe80::6a5f:3c9e:5ccd:8e5f]) by MN2PR17MB2958.namprd17.prod.outlook.com ([fe80::6a5f:3c9e:5ccd:8e5f%5]) with mapi id 15.21.0048.016; Mon, 25 May 2026 03:24:24 +0000
From: Andy Boell <andy@midwestcyber.net>
To: dnsop WG <dnsop@ietf.org>
Thread-Topic: Request for feedback on draft-midwestcyber-dspip (DNS-based key distribution for physical item authentication)
Thread-Index: AQHc6/XdVti9K1eV20KotQw+VV1ZIQ==
Date: Mon, 25 May 2026 03:24:23 +0000
Message-ID: <MN2PR17MB2958BD948EE9FD7C247DA06EA30A2@MN2PR17MB2958.namprd17.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=midwestcyber.net;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MN2PR17MB2958:EE_|LV0PR17MB7571:EE_
x-ms-office365-filtering-correlation-id: 82c42266-1edb-4e01-28de-08deba0d1e5e
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|6049299003|376014|366016|1800799024|38070700021|3023799007|6133799003|56012099003|18002099003|13003099007|8096899003|4053099003;
x-microsoft-antispam-message-info: enuSojK0oPvo+5kMYcBB09mb4xNKHeIBqPyhDI+KcCvaqV/9sq13pG0vbCuCY2lCcBO9XAL4i/KUygIJXHcXsT4F+F0AgXgBwILhQ+5nW1u9n6jSTPBGYpN1ld8J6M7hf1rSepmAA2eWHaLfSRMXGdDU1Bsmu9KZnJYhKwPb3PjvF05Q0DU+HiUoeV9M0KfimpVxlXh2mDxpMaU3Wo5EcZTAbZgFyj7qAUYImpwQxmZOrz7Iey2lriWhJfx6E+AxJgjIrmu/kRwgxPMHIpSZSgaShz6xZqCs2ixDAwIU+NMmYNekhelGJl+dhc9FHEkKbpDal9Ju2pTY0ZJwQL2zaRgECPdredCKVenj0GN0tRIN06GwWa/SprzWEMtNAuOjQJYAWbVab/d9DkJc9uRgo8oCs/zyvD0us+j72oGoNH2CGxq/ov/ZJZZgyP9Oc4O8YxUrLsJ7o3XKLUYKmMFXYyEIxZMUf4vajvI1s4oaJUz7TEY6MNcos3o5bz4Ybk9LyDbU91nb6SrqDvjop+ZuXM8mAPM/JKKA452a3GBUEGHeO78oOk9Xtx03oX3i3V4y8WO2BxbU6TXK9myz9ueGOSeZKB8I0jAJbNIv9NnmLSeEGhUL/UxdiLrbvJhWfb344K++6rKVBMcrJ2FVwkJnngr9ESHTJqQICKI9dU65DV3HqMtiYgSZ6qcK8+rqfbX9+uDo2YMLxHGEqSZvgFMTLg==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR17MB2958.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(6049299003)(376014)(366016)(1800799024)(38070700021)(3023799007)(6133799003)(56012099003)(18002099003)(13003099007)(8096899003)(4053099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 7cZW6uPKj7uDXJyWJRvYXj/+nZCFSPm7d5xenYFnYcl5yxDggGxoWuvDo7Ya94ovMudJc1tDUKv9kH8GH4JHlV+XEYqav6PxDukz8JrDhzoELU9eMT9sLR79808IPw7iGpJncI6kiLzzlUcaq1rWp5vGdbeHHUZDPqsvahQbTFAmmBcHmjLmtu50CnzCkdxZjlYGSkqvMFhZDqTgtdwn5urMbk2GGBm/CPXM9QBXx6izhNhRz8dyVrKmWa2pMRaTNRvCnZh/86zSo65fg4TkK3TafO0BX3KoTmJfAk83W7Tm94IXQRBl6jnFwNlFW3RacmNOZ4/CTpI6QR1f+sqrS7A0oWjp4vkjuDlVmXIQtUx8zlQCnLOEIDZAO+tbWrtXBfcsyFhLDAsciawadmg+kf3oNWX6t56cNU+odW2CQP4ycGfH8y7nc5/LNy3KUE2lmd6/ylYtcgp6OWxE2qJV/9wJKUlolc1lmzExXHkAyvbVlOyVZrhEknn3gtgoDvTqs/wmOd5OwXWXjugXFjWpOH3k12FZRoM9XAz4vwY+Oz7vDXa2Su1S7Y8Q4GzLlK56N/DVNprYQ3YXdeuIrWN54L7hTaHnuBq67lbi5jJQabjrajAI051pXcuvJdpIdRaW2BiVd9aXrOTPYlJiDqMma8vmAKkvC9ejpuxIonoVjodfvdNfGm9d+IF/iWE9r1MnwLiLZdtIGspjXZcxJmXw+GGpE2zss6CYRnpEOk88QLfRqxigDk/+GiRwob3/72EazGWii65rslxTwIfG7TSupId+wR1k8iTmo5rJFlebdGb5PdYrLbUyD24hcIfLagq1GDb8xyAJFoi+cHWJJwMgvN+arRZN9pgBBJo/4Vm2UqkSAdHY8xIPj8QXdlct7STHtFA5P6dUp7qv+tHZALu03YENd6GvN+llSxHmj6JrfhEXubsZsWf3KxPjHBBf8S8f/BPlqfeM/7MR8VanPOKy6PN5DLhmb6m22BTlr+d3PC1pq6ixu2TDDyynTPH3VkQGWWfrFmhKKYZslJktyDuhXS8ffRDC0l3MWZNw3mOTfl62Zh+i4yA2vBpAxudc66LiH2Mlhfb/4wgesqDCUCql7PGnQEvomfR27wo+KfOrN570NNTomvRKpl6S3H7AVWBgl0oO47cHdPf4J+IR78411UFPSEbar/JxPPEZc2ia5pVsTiU+9C0IrwpJP0OSqB02viRYyWHpwimLtxrupPSVe+e8jf/HeepCJGVx0TDUwBQdwWi0a7pxEWwJS8bGZfpkBn1SxmnEsYmZTiuS2ml5bT53C0NO2Fa/BKnhQhSRhd1M4Q9KP7pg5y7JC2hwN1kewGc4yCJmZ6vknL0BuDIVaML2SqE5fiYkW5EWGUxpBCWA6517gDpl6zatQ7yCn9YHRgOaBjiInhYRhG3en8bBQbE0WdCKMXcit6UNUODEPDC37M9+QxOCsUJ720qgCfbbuiCO7/JcfLagf7fTmTteaGPMFwY0LiNrs/JjGiV8bkUxNEbcF+gijxL98nuoT+XbPvHZyYU+RBdldYkJY+WaEQGuZMm3OwlM9wuijS7OfVSWcLqJNLD6gaqk6i6fj85eomWFXmj3c0plZYuqnJInuuDBbJbKavBTHQL0cvLT5i0ZKRYxWtm2b1+jzJ2TqJMf25ztjVPgeP7BXvfnSzoueT9bqYLp01Ld28nFN1NuNNWGxlWiD/FxdlKbOuLz+B/m
Content-Type: multipart/related; boundary="_004_MN2PR17MB2958BD948EE9FD7C247DA06EA30A2MN2PR17MB2958namp_"; type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: midwestcyber.net
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MN2PR17MB2958.namprd17.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 82c42266-1edb-4e01-28de-08deba0d1e5e
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 May 2026 03:24:23.9889 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 98c19a9c-9381-45d6-9a25-d013f67fbe2b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: f1QX3sfLexvCt3JW5cK3ZkmiySMgiLx7F3JDB05YR+bPV7R8CvXjGyYdp9ZlAcnFNf78J1CR5cQ9E4PKn1qyXg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV0PR17MB7571
Message-ID-Hash: WP45NKOBPBQ6IRFYDDMRJEJK4XF3VKHC
X-Message-ID-Hash: WP45NKOBPBQ6IRFYDDMRJEJK4XF3VKHC
X-MailFrom: andy@midwestcyber.net
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Request for feedback on draft-midwestcyber-dspip (DNS-based key distribution for physical item authentication)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/6NesOl8mqf6OxhZs1dS5jdnxXfk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>
Hi DNSOP, I recently submitted an individual Internet-Draft and would appreciate feedback from the working group, particularly on the DNS-related aspects and whether this work fits within DNSOP scope. Draft: https://datatracker.ietf.org/doc/draft-midwestcyber-dspip/ Title: Digital Signing of Physical Items Protocol (DSPIP) Summary: DSPIP defines a cryptographic protocol for authenticating physical items (e.g., packages) using digitally signed QR codes. The protocol provides origin authentication, chain-of-custody verification, and privacy-preserving delivery mechanisms. One key component is DNS-based public key distribution (similar in spirit to DKIM), where verifiers retrieve public keys via DNS TXT records to validate signatures associated with physical items. I’m particularly interested in feedback on the following: 1. DNS usage model: - Suitability of DNS TXT records for distributing DSPIP public keys - Naming conventions (e.g., service prefixes, delegation patterns) - Alignment with existing practices (e.g., DKIM, other DNS-based verification mechanisms) 2. Operational considerations: - Caching, TTL, and key rotation implications - Resolver behavior under high-volume verification scenarios (e.g., logistics scanning) - Any concerns around abuse, scaling, or query patterns 3. Prior art / overlap: - Whether similar approaches exist that I should align with or reference - Any relevant DNSOP work I may have missed 4. Process guidance: - Would DNSOP be an appropriate venue for this work, or should I seek feedback elsewhere (e.g., dispatch or another WG)? All feedback is welcome, and I’d especially appreciate pointers on how to refine the DNS-related aspects to align with IETF best practices. Thanks in advance for your time and input, Andy Boell Midwest Cyber, LLC (402) 332-6542 https://www.midwestcyber.net andy@midwestcyber.net [cid:0374d91d-ac27-4b4f-86ed-ad8a32b28698]<https://outlook.office.com/bookwithme/user/4657c97c36ce4841b0b69da8bb156195@midwestcyber.net?anonymous&ismsaljsauthenabled&ep=bwmEmailSignature> Book time to meet with me<https://outlook.office.com/bookwithme/user/4657c97c36ce4841b0b69da8bb156195@midwestcyber.net?anonymous&ismsaljsauthenabled&ep=bwmEmailSignature>