Re: [hybi] DNS SRV for WebSocket

[Dave Cridland <[e-mail]>]

On Mon Mar 28 11:36:32 2011, Thomson, Martin wrote:
> On 2011-03-28 at 09:55:37, Dave Cridland wrote:
> > They are generally not used for port selection, but to allow the
> > diversion of a service from one name (the domain) to another (the
> > providing host).
> 
> Security on that front is a little iffy.  See  
> draft-barnes-hard-problem.

Actually it's straightforward from a technical standpoint, until you  
delegate services across administrative boundaries. Again, the XMPP  
world has been successfully authenticating using X.509 certificates  
with SRV records in play for many years.

Richard's been working closely with the XMPP community to find a  
solution to the "HARD" problem of cross-boundary delegation, but  
meanwhile I'd note that the problem exists with HTTP just as much as  
with XMPP and other SRV-using protocols, the primary distinction  
being that there is no explicit delegation visible, so people don't  
notice it as much. (Which is odd, since in HTTP there is a far  
*higher* delegation level for secure sites, as few as there are).

The actual problem only exists in the case where the private key  
cannot be given to the hosting organization, and I'd note is easier  
to solve if SRV records exist, thanks to DNSSEC (and the ability to  
then validate the delegation to an intermediate indentity one can use  
in the certificate).

So in summary, SRV records actually simplify the problem.

Dave.
-- 
Dave Cridland - mailto:[e-mail] - xmpp:[e-mail]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade