Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Rick van Rein <[e-mail]>]

Hi Vik,

>> The value of PTR is a <domain-name> rather than a binary <character-string>,
>> which makes it case-insensitive and I wouldn't be surprised if some name
>> server mangled the case of PTR records to all-lowercase.
>
> No, it is not "case-insensitive".  The value of PTR records is
> returned verbatim by nameservers.  What's case insensitive is
> lookups derived from that name when you use it in a query string.

RFC 4343 states that DNS compression of domain names can lead to
conversion of case for RRtypes defined in RFC 1035.

There is another reason to prefer a binary format, and that is to leave
the door ajar for future i18n attempts of Kerberos realm names.  That is
hard enough as it is now, without having to deal with DNS i18n as well.
>
>> Finally, the PTR record already has its meaning, and that is not the one
>> we have in mind.
>
> It it *exactly* the meaning you have in mind.  A DNS name that is
> not an alias.  A pointer to another place in the DNS.

Assuming a Kerberos realm from a DNS name is not automatically safe
because it may not be intended as such by the DNS zone operator /
signer.  Because not all DNS names are intended to be, or have Kerberos
realms.  That is the problem with overloaded / mind-read types that also
have anohter life.
> Many firewalls mistakenly filter "exotic" DNS queries.  The KREALM
> RRtype will encounter unnecessary friction.

I know that, the same can happen to DNSSEC queries.  It is why I expect
this to be easier to implement on a KDC located in a customised
networking context than on a Kerberos client in an undefined
environment.  Still, that is quite acceptable, as long as
canonicalisation will allow the KDC to respond with Cross-Realm Routing
hints as in Section 9 of RFC 6806.
> With the PTR record, UTF-8 labels in Kerberos realms can be converted
> to A-labels in zone files and on the wire, with the client mapping
> them back to U-labels to reconstruct the realm name, and using the
> A-labels directly to locate SRV records, ...

I would like to hear if i18n experts agree to such mappings.  And
especially in the context of Kerberos, where we are dealing with older
applications that were a bit too liberal with what they put into their
realm name fields.
> Kerberos realms in DNS should be DNS names,

I've found that people in the Kerberos community treat old habits as
things that die hard.  What you are saying probably applies to 99% of
the users, but I see no point to forbid other forms of realm name in
DNS.  If others agree with Vik, then a +1 note may help, because without
more of those I simply fear making a dramatic choice that will make
people dislike this proposal.


Thanks,
 -Rick