Re: [TLS] draft-shore-tls-dnssec-chain-extension-00

[Paul Wouters <[e-mail]>]

On Mon, 29 Jun 2015, Melinda Shore wrote:

> Subject: [TLS] draft-shore-tls-dnssec-chain-extension-00

> We've submitted a initial draft describing a TLS extension for
> the transport of a DNS record serialized with the DNSSEC
> signatures needed to authenticate that record.

So this looks similar to the earlier "put it in an X509 attribute"
experiment that chrome did for a while. If it makes browser people
happier to use DNSSEC, I'm all for it.

Although I would be happier if we just shipped a binary DNS packet
blob (minus transport header) that could be given to a dnssec
validation library as if it came from a remote DNS nameserver. I
don't really see the use of a new DNS transport format, as the DNS
packet format can already be used to add a large number of records.

Additionally, code on nameservers for draft-ietf-dnsop-edns-chain-query
could directly be used to generate the TLS extension data blob as well
for the TLS server.

Having browsers have some kind of "validate this chain of DNS records
that is asumed to be in some validation order" seems awfully specific
code that is "just not DNS enough" to cause problems. I'd rather see
the data fed into existing real dns validation libraries.

Paul