[kitten] Finding Kerberos Realm Descriptors in secure DNS

[Rick van Rein <[e-mail]>]

Hello,

On DNSEXT, I’m discussing a new DNS record named “KREALM”, proposed here
before, to resolve things in secure DNS that the Kerberos specs didn’t
trust to put into DNS in the past. The thread can be found at
http://www.ietf.org/mail-archive/web/dnsext/current/threads.html#13822
and the I-D itself is located at
https://tools.ietf.org/html/draft-vanrein-dnstxt-krb1

Where SRV records to kerberos’ own services are secure because they rely
on sharing a secret, and the mapping of DNS-style realm names to
case-insensitive DNS names has been standardised (ignore case, don’t
define two realms that only differ in case), there is no good option yet
to come from a DNS name to a realm name; not form a realm's DNS name
back to the realm name and not from a service's hostname to a realm
name. This is what KREALM tries to establish, using DNSSEC to provide
authenticity.

Think of service descriptions to find the realm for
HTTP/www.example.com, like

_http.www.example.com. IN KREALM “realm” “EXAMPLE.COM”
_http.www.example.com. IN KREALM "service" "HTTP"

(when not found, searches move upward in the DNS tree but not beyond the
zone apex; the I-D specifies an efficient, DNS-folk-agreeable way of
doing this)

but also think of realm descriptive information like

example.com. IN KREALM "realm" "EXAMPLE.COM"
example.com. IN KREALM "admin" "john/[e-mail]"
example.com. IN KREALM "admin.uri" "http://www.example.com/contact.html"
example.com. IN KREALM "admin.uri"
"ldap://ldap.example.com/?cn=John+Smith,dc=example,dc=com"
example.com. IN KREALM "admin.cert" "admcert.example.com."
admcert.example.com. IN CERT ...

Now, the question surfaces what use cases of KREALM records could exist.
I’ve identified three or four:

 1.

    Kerberos client (or his KDC) knows service name + hostname, and
    wants to find a realm name

 2.

    Kerberos node wants to find the case-sensitive realm name for a DNS
    name, in a secure manner

 3. Kerberos node wants to find automatic validation information for a
    realm administrator (principal name)
 4. Kerberos node wants to find manual contact information for a realm
    administrator (perhaps through a URI and/or CERT record with an
    X.509 or PGP certificate)
 5. (optional) Kerberos client wants to perform service discovery under
    a realm and/or at a DNS name

Based on these, I should be able to formulate the keys and search
patterns for the data. I am aware that the keys will be vital for trust
in the information found!

If you have anything to add (or remove) then please let me know!
Everything will be setup to be extensible, and there should be non
reason why an admin would be forced to comply to a use case for their
services if they don’t want to, of course.

-Rick

​