Re: [DNSOP] new Resource record?

[Jared Mauch <[e-mail]>]

> On Dec 9, 2015, at 3:25 PM, Hosnieh Rafiee <[e-mail]> wrote:
> 
> Hi,
> 
> Since DNS is a very important service on the internet, for several security
> processes, it can be used as a powerful system. So far, some resource
> records were proposed for certificates, keys and other values.
> 
> I would like to suggest the following format (this is the rough version and
> it is not exact but only giving you an idea that what is the purpose) for a
> new resource record to store the reference information of bounding of
> authentication and authorization where authentication can be based on public
> keys or certificates.
> This means each reference no represents an actual policy template in other
> security system or other services. This means if a certificates bound to
> more than one references, then more than one of this section is added to
> RDATA section of the DNS query. This also should be updatable by the DDNS
> protocol.
> BTW, I skipped the header and other parts of RR and this part is only the
> RDATA section.  
> 
> -----------------------
> |flag| reference no   |
> -----------------------
> | some human readable |
> |       text          |
> -----------------------
> 
> The processes are also simple, when a node query the certificates, DNS
> server also includes this RR if it exists on the DNS server so that when the
> querier retrieves this information, it can query other services for the
> given value to authorize the other host on the network. 
> 
> Is DNSOP a right place for that? I asked DANE and they said it Is not in
> their charter. If not, please tell me where is the right place. If yes,
> please tell me what do you think about that and whether or not you support
> it to draft it.

People have done things similar to this over the years.  I remember software
once distributed UNENCODED over sequenced DNS TXT records.

It seems something like TXT would be the best way to do this, eg:

dig txt 1.255.42.204.in-addr.arpa.

Nothing really stops you from putting a “Seq-01-Base64-Blob” out there.

You might be able to use HINFO for that as well since it’s designed for two
fields already.

- Jared