[DNSOP] Re: New I-D: draft-callec-dive-00 (Domain-based Integrity Verification Enforcement)

[Ben Schwartz <[e-mail]>]

This is an interesting idea, and noticeably related to
https://mailarchive.ietf.org/arch/msg/dnsop/q6TZjY--IskxbUKfqqhUKpJIJkw/.

I would encourage you to make the draft less verbose.

I recommend making more use of existing, relevant components such as HTTP
Message Signatures (RFC 9421).

I recommend drawing a clear separation between the "object security for
HTTP" aspect, depending on a trusted public key distributed out of band,
and the DNS distribution of that key.

I recommend starting in HTTPBIS, not DNSOP, as most of the utility and
complexity of this proposal is on the HTTP side.

--Ben

On Fri, Apr 3, 2026 at 6:59 AM Matéo Callec <mateo=
[e-mail]> wrote:

> Hi everyone, I have submitted a new individual Internet-Draft:
> "Domain-based Integrity Verification Enforcement (DIVE)"
> (draft-callec-dive-00). - Draft link: https: //datatracker. ietf.
> org/doc/draft-callec-dive/ - Reference Implementation: https: //github.
> com/diveprotocol/opendive-client
> 
> Hi everyone,
>
> I have submitted a new individual Internet-Draft: "Domain-based Integrity
> Verification Enforcement (DIVE)" (draft-callec-dive-00).
>
> - Draft link: https://datatracker.ietf.org/doc/draft-callec-dive/
> <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-callec-dive/__;!!Bt8RZUm9aw!_EmR73x75nwsbuGw7aEKBcwSTzL-gTay1Rkz9ARK1v-7-4NgB6Adyd0yKCedzowE3waftCQLG6aY7ty-Vz2BfgHyXtY$>
> - Reference Implementation:
> https://github.com/diveprotocol/opendive-client
>
> ---
>
> 1. Abstract & Problem Statement
>
> DIVE is a protocol designed to ensure resource integrity by using the DNS
> as a secondary out-of-band source of trust.
>
> While existing solutions (like PGP-signed repositories or specific package
> manager keys) work, they often face challenges regarding key revocation,
> rotation, and distribution. If an attacker gains full access to a web
> server’s infrastructure, they can often serve malicious files along with
> updated (but compromised) checksums.
>
> ---
>
> 2. How DIVE Works
>
> DIVE decouples the file storage from the integrity verification key:
>
> - Transport: The server delivers the resource and a signature (via a
> dedicated HTTP header).
> - Verification: The client fetches the public key from a DNS resource
> record, secured by DNSSEC.
> - Validation: The client verifies the resource's integrity using the
> out-of-band key.
>
> This mechanism ensures that even if the HTTP server is fully compromised,
> an attacker cannot bypass integrity checks without also gaining control
> over the DNSSEC-protected zone.
>
> ---
>
> 3. Key Benefits
>
> - Rapid Revocation: Key revocation is as fast as DNS TTL propagation.
> - Multi-Key Support: The protocol allows for multiple active public keys,
> enabling key rotation without downtime and supporting diverse signing
> authorities for the same domain.
> - Granular Control: Keys can be restricted to specific subdomains.
> - Deployment Ease: Supports a report-only mode for progressive rollout
> without breaking existing workflows.
> - Resilience: An attacker must compromise both the web infrastructure AND
> the DNS/DNSSEC signing infrastructure (or the private keys associated with
> the DNS records) to successfully serve a signed malicious file.
>
> ---
>
> 4. Proof of Concept
>
> A reference client is available via "pip install opendive-client". You can
> test the verification logic with the sandbox:
>
> - Valid file: opendive download
> https://sandbox.diveprotocol.org/downloads/valid.txt
> <https://urldefense.com/v3/__https://sandbox.diveprotocol.org/downloads/valid.txt__;!!Bt8RZUm9aw!_EmR73x75nwsbuGw7aEKBcwSTzL-gTay1Rkz9ARK1v-7-4NgB6Adyd0yKCedzowE3waftCQLG6aY7ty-Vz2B7MwiB3o$>
> - Invalid file: opendive download
> https://sandbox.diveprotocol.org/downloads/invalid.txt
> <https://urldefense.com/v3/__https://sandbox.diveprotocol.org/downloads/invalid.txt__;!!Bt8RZUm9aw!_EmR73x75nwsbuGw7aEKBcwSTzL-gTay1Rkz9ARK1v-7-4NgB6Adyd0yKCedzowE3waftCQLG6aY7ty-Vz2BZ8HCf48$>
>
> I would greatly appreciate your feedback. Is this something the WG would
> find interest in pursuing?
>
> Best regards,
> Matéo Callec
>
>
> _______________________________________________
> DNSOP mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>