Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Rick van Rein <[e-mail]>]

Hi Viktor,

> Text strings used to be handy for realm names in DNS when associated
> SRV records were plausibly optional.  These days, the REALM *should*
> be a DNS name.

If that's not MUST then I don't think it's a safe assumption to make.

> Therefore, a simpler design would be:
>
>     ; Realm mapping per-host reduces lookup latency
>     ;
>     _kerberos.host.name.example.com. IN PTR EXAMPLE.COM.

The value of PTR is a <domain-name> rather than a binary <character-string>, which makes it case-insensitive and I wouldn't be surprised if some name server mangled the case of PTR records to all-lowercase.

Also, the trailing dot is not the only form that may be used; there can be relative names.

And, you are using PTR in forward DNS, which may upset people.

Finally, the PTR record already has its meaning, and that is not the one we have in mind.  The new RRtype can be hard and clear about its meaning for Kerberos, and avoid security questions relating to the use of certain records.

I've initially proposed overloading TXT and that gave strong responses to instead register a new RRtype, and nobody on DNSEXT is questioning that change.  I therefore propose to not follow your idea.  It made me smile though, because it is an interesting find.


Thanks!
 -Rick