[Trans] How to make use of DNSSEC + TRANS

Phillip Hallam-Baker <phill@hallambaker.com> Tue, 20 May 2014 15:09 UTC

MIME-Version: 1.0
Sender: hallam@gmail.com
Date: Tue, 20 May 2014 11:09:13 -0400
Message-ID: <CAMm+LwiR_41LoygdGORe6otFrqYjRkDVbQqOzigc4ooJWvpkSA@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
To: "trans@ietf.org" <trans@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/trans/6l8ZN-5-zY0-0agjZeMLmTzN9kw
Subject: [Trans] How to make use of DNSSEC + TRANS
Precedence: list

I started this discussion on the Apps list but the technology that
would make it work is TRANS so I thought I would raise it here as
well.


One of the big problems with DNS is that I don't buy a DNS name, I can
only rent it. And that means that names that are DNS bound can always
be reassigned in the future. Which is one of the reasons why HTTP urls
are unsatisfactory.

Larry Masinter has of course raised this sort of concern before and
proposed dated URLs. But this morning a different approach to the
problem occurred to me:

Lets take a URL at a web site and imagine I download a page on 1st Jan 2010:
http://www.cnn.com/whatever.html

Now what if I wanted to connect up today to the same party that I
connected to last time. This is not the same as the URN or the dated
URL problem. I want to connect up to the same entity regardless of
whom ICANN happen to sell the domain name to next.

How about one of the following:

http://www.cnn.com.2010/whatever.html
http://www.cnn.com.1.2010/whatever.html
http://www.cnn.com.1.1.2010/whatever.html

DNS labels are not allowed to be all numbers but the DNS protocol
works for them. In fact they seem to work with my existing software
which was not a design goal but would be cool.


Now resolving such names would of course require a new infrastructure,
quite possibly a subscription infrastructure that would track the
changing ownership of the names over time. And this infrastructure
would probably involve Certificate Transparency like services and
DNSSEC.

But we could use this to provide persistence for Web content and for
Web services which would be incredibly cool.


We can also apply the same idea to email addresses:

phill@hallambaker.com could be anyone.
phill@hallambaker.com.16.5.2014 is uniquely my account.


So the infrastructure that would be required here would be

1) A set of trans notary logs that people could register their DNSSEC KSKs in.

2) A set of DNS servers that accepted DNS zone updates for dated zones
from the keyholders of the registered keys.


The practical effect would be that once a name was registered and the
key enrolled in the log, the holder of the key can then maintain the
claim to the dated zone for as long as they hold the key. Resolution
will continue to function as long as the keyholder provides updates.

One of the uses for this type of technology would be in cyber conflict
situations where we want to make use of a naming infrastructure that
does not introduce a possible point of compromise.

[Trans] How to make use of DNSSEC + TRANS Phillip Hallam-Baker