Re: [Trans] DNS for CT

[Ben Laurie <[e-mail]>]

All these should be fixed now.

On 24 February 2016 at 05:06, Ben Laurie <[e-mail]> wrote:

>
>
> On 24 February 2016 at 00:12, Paul Hoffman <[e-mail]> wrote:
>
>> On 23 Feb 2016, at 8:00, Ben Laurie wrote:
>>
>> As we've mentioned several times, we've been working on a way to retrieve
>>> CT data over DNS to improve the privacy properties of inclusion proofs.
>>>
>>
>> This is a good idea, and the motivation mentioned in the not-yet-a-draft
>> is good. However, I have some questions about the protocol that you show.
>>
>>
>>> https://github.com/google/certificate-transparency-rfcs/blob/master/dns/draft-ct-over-dns.md
>>>
>>
>> 1) Why do you create a new Opcode for the header? These are kind of
>> precious values. You are already using prefixes on the QNAME for STH
>> queries; you could easily do so for the others as well.
>>
>
> I don't think that was intentional - we're not actually using a different
> opcode!
>
>
>>
>> 2) Standard practice these days is to have prefixed labels start with an
>> underscore (_).
>>
>
> You mean like in SRV records? It wasn't particularly intended that these
> would be on a domain used for anything other than CT... but no particular
> objection, either.
>
>
>>
>> 3) In the STH Query example, the Question section in the response is
>> different than the Question section in the request. I hope this is a typo,
>> given that RFC 1034 says that the two must be the same.
>>
>
> It is.
>
>
>>
>> 4) If you sure that the RData values for the responses are less than 256
>> characters, that's fine; if they can be longer than that, you should
>> probably add a note about the TXT records having more than one
>> character-data string.
>
>
> We were trying to avoid that happening...
>
>