Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Rick van Rein <[e-mail]>]

Interesting :)

While talking on DNSEXT, the complexity of KREALM started to explode, and that's why I came up with use cases as a guideline.  What you're now telling me is that there is only one real problem for Kerberos (to which I agree) and that the rest is not specific to Kerberos (which I hadn't realised yet, but agree with too).

So, time to simplify.  What we're now looking it is a very simple KREALM record that says stuff like

www.example.org.  IN KREALM  "EXAMPLE.ORG"
                  IN KREALM "EXAMPLE.COM"

if it wants to state the Kerberos realms to consider for the DNS name www.example.com.  As a freebe, we're also getting the possibility to say

example.org.  IN KREALM "EXAMPLE.ORG"

so we now how to spell the DNS-name's realm in proper case.  But although that's defined (somewhere) as missing-because-not-secure, it is not actually necessary for Kerberos to function.  Which is true.

I'm also pulling back my thought on permitting the more complicated use cases, because you've convinced me that this is not Kerberos-specific stuff.

I want to rethink offline how I got to the current proposal, because I think I originally started with precisely this...

> I would also drop the zone apex business.

I definately won't define iteration that passes through the zone apex because the DNSKEY switch makes that a security problem, but I can agree to not iterating at all.  In that case, we'd simply have to specify a KREALM record next to each server name.  Still, that's quite acceptable I think, even if it replicates data in multiple places of a zone; by now I'm convinced that the alternative adds too much complexity.  And at least the records got simple again :)

FWIW, wildcards won't work to define KREALM for all servers in a zone -- a server will have an AAAA or A or SRV record for the server's hostname, which interferes with a matching wildcard.

If you guys are happy with this, I will redraft and post it here and return to DNSEXT.

Thanks for the fireworks ;-)
 -Rick