Re: [xmpp] Fwd: I-D Action: draft-miller-xmpp-dnssec-prooftype-01.txt

[Philipp Hancke <[e-mail]>]

Am 27.06.2012 18:19, schrieb Matt Miller:
> On Jun 27, 2012, at 09:16, Philipp Hancke wrote:
>
>> i'm pondering on the proof name. The prooftype is using dnssec, but uses it to extend the 6125 to allow secure delegation.
>> I.e. it either explains how to do delegation within a PKI prooftype or is a proof PKI-Delegation proof.
>>
>> DNSSEC alone might (mostly in the context of s2s and server dialback) be a different proof (used by the connecting server instead of dialbacks current faith in insecure dns).
>>
>
> First; Peter and I will be submitting a new DNA (Domain Name Associations) draft soon, which defines a few terms like "prooftype", "delegation method", and "assertion mechanism".  The goal is to have it published before the end of the week, so stay tuned!
>
> I don't think if DNSSEC in and of itself is really a proof; it's not providing verification material directly.  I do think it is a delegation method, which then makes dialback keys a worthwhile prooftype!

I expect dial-back keys (the xep 0185 stuff) to (gradually) become 
obsolete. The cridlandish samecert optimization yields a similar proof 
of possession using the shared private x509 key and has less 
round-trips. There are a few cases where this does not work, typically 
large sites that use multiple certificates, but one might expect them to 
deploy DANE.

DNSSEC still helps to ensure that you send stanzas to the right peer.