Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Nico Williams <[e-mail]>]

On Tue, Sep 15, 2015 at 07:30:30AM +0000, Viktor Dukhovni wrote:
> Text strings used to be handy for realm names in DNS when associated
> SRV records were plausibly optional.  These days, the REALM *should*
> be a DNS name.  Therefore, a simpler design would be:
> 
>     ; Realm mapping per-host reduces lookup latency
>     ;
>     _kerberos.host.name.example.com. IN PTR EXAMPLE.COM.

Clever.  I like this a lot.  For ASCII labels we even get the correct
case, whatever the server returns.  For IDNs, well, we haven't crossed
that river yet for Kerberos.

>     ; "Fallback" realm mapping at ancestor domain
>     ;
>     _kerberos.example.com. IN PTR EXAMPLE.COM.

The problem with the fallback thing is that we don't know how many
labels up to go, if any.  Should example.com. have an A RR but no
_kerberos.example.com., should we go ask com. what example.com.'s realm
should be?  Clearly not, but now try constructing a general rule...

>     ; Associated SRV records
>     ;
>     _kerberos._udp.example.com. IN SRV 0 100 88 kdc.example.com.
>     _kerberos._tcp.example.com. IN SRV 0 100 88 kdc.example.com.
> 
> This does not require a new RR type, PTR will do.

+1

Nico
--