Re: [kitten] Draft Action: draft-vanrein-dnstxt-krb1-01

[Benjamin Kaduk <[e-mail]>]

On Tue, 16 Dec 2014, Rick van Rein wrote:

> Hi Benjamin,
>
> > I did a fairly quick read and did not spend a whole lot of time trying to
> > process everything.
>
> Thanks, and sorry for the late reply.  It’s that time of year that everything must be finished.

Understood.

> > The utility of the concept of a "Home Record" (and related) is not clear
> > to me.  It seems the document could be shorter if it didn't bother with a
> > distinction, and I'm not sure what would be lost if it did.  This is not
> > to say "you should remove them", but if you want to keep them, please help
> > the reader understand why they are there :)
>
> OK.  Since I’m following the suggestion to define general tag=value setups,
> and subsequently proposed an IANA register for tags, I felt a need to
> separate these two classes of records.
>
> The idea is a security matter; and should perhaps be explained better.
>
> A record for EXAMPLE.COM situated at example.com has more right
> to speak about the realm than a record for EXAMPLE.COM situated
> under example.org.  The first is a “home” record, the second would be
> a mere reference.  In the second case, when an application needs info
> from a "home tag”, it would first resolve example.org to point to the
> EXAMPLE.COM realm, then lookup the home record under example.com
> and from there harvest the additional tag value.
>
> The general idea being that a “home record” is DNSSEC-signed to be
> authoritative for the realm, which is not true for a mere reference.
>
> Does that help?

That does help, yes.

> I am not actually using this distinction in the document, so it is purely for
> the sake of the general registry and possible future expansion that it
> enables.  I do not believe that it is valid to remove the home record
> distinction without also removing the registry of tags.
>
> Whether putting up a registry is useful for future expansion, or merely
> added administrative minutia is open for dicussion as far as I’m concerned.
> There is definately something to gain from sticking to a fixed set of tags:
> simpler syntax, simpler parsing and simpler processing.
>
> > The general structure seems like a reasonable chunk to bite off at once,
> > handling a bit more than just realm names, and providing a reasonable
> > mechanism for future extension.
>
> Glad you like that.  Have I convinced you that future tags might be
> specific for references, and/or specific for home records?

I don't think you have quite convinced me, but neither do I remain
unconvinced.  I would need to think about it for longer than I can right
now (and it's unclear that the issue is important enough for me to spend
that time in the near future).

-Ben