Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Nico Williams <[e-mail]>]

On Mon, Sep 14, 2015 at 10:11:16AM -0500, Nico Williams wrote:
> On Mon, Sep 14, 2015 at 10:35:54AM +0200, Rick van Rein wrote:
> > (when not found, searches move upward in the DNS tree but not beyond
> > the zone apex; the I-D specifies an efficient, DNS-folk-agreeable way
> > of doing this)
> 
> I'll have to look.

I don't think that the zone apex is necessarily a good place to stop.
DNS delegation does not imply as much as you make it out to.  I'm not
sure what the best thing to do here is.  I'll think about it.  But I'm
quite certain that DNS zone cuts are not the right thing to use.

Also, your method is:

|  5.  When the type bit map in the secure denial indicates the presence
|      of a SOA record under the current name, then no further
|      iterations are possible, and the algorithm ends in failure.

which fails if there are KREALM RRs for some things but not realm.

I think the "key" part of the KREALM RR RDATA may be best as an
_-prefixed label in the qname (not least as it reduces response size, at
the expense of increasing the number of queries when the client needs
more than one key's RDATA, but this is fine I think).

Then there'd not be much difference between a KREALM RR and a TXT RR...

Nico
--