[TLS] Service Binding DNS Records (draft-nygren-service-bindings-00)

[Erik Nygren <[e-mail]>]

Following some discussion in both the TLS and HTTPBIS working groups at
past meetings (including in the TLS interim), it became clear that there
was a need for a mechanism more flexible and powerful than SRV records for
communicating parameters for establishing a connection to clients.  In the
TLS 1.3 world, one specific use-case is to bootstrap any handshake
encryption via the DNS.

One of the major browser concerns is limiting the number of DNS lookups
that need to be performed before establishing a connection, especially when
multiple records that may only exist a small fraction of the time need to
be hunted for.  This proposal attempts to limit that while also enabling
future flexibility.  In particular, I believe this proposal also makes
DANE/TLSA much more operationally viable for HTTPS use-cases.  Regarding
the concern that the adoption rate for new record types is slow, this is
explicitly an additional mechanism for now (such that clients should fall
back to A/AAAA address records and such when unavailable), especially as
the security functionality enabled in the first version is primarily
opportunistic.

Feedback is most welcome and I'm happy to discuss more in Toronto.  This
does not yet have a working group home yet, especially as it spans the
interests of a number of WGs.  There are also plenty of open issues, and
I'd like to land on the concepts before getting into final details of
encoding:

      http://tools.ietf.org/html/draft-nygren-service-bindings-00


---------- Forwarded message ----------
From: <[e-mail]>
Date: Fri, Jul 4, 2014 at 12:39 AM
Subject: I-D Action: draft-nygren-service-bindings-00.txt
To: [e-mail]



A New Internet-Draft is available from the on-line Internet-Drafts
directories.


        Title           : Service Binding DNS Records (DNS B)
        Author          : Erik Nygren
        Filename        : draft-nygren-service-bindings-00.txt
        Pages           : 16
        Date            : 2014-07-03

Abstract:
   This document describes a DNS "B" RR which binds together information
   needed to establish connection to a service across multiple protocol
   layers, including the location of the server, the application-level
   protocol, and security bootstrap information.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-nygren-service-bindings/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-nygren-service-bindings-00


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt