[xmpp] Commonality of proof types

["Richard L. Barnes" <[e-mail]>]

Just musing on what proof types look like...

During the DANE process, Adam Langley proposed a way to serialize 
"DNSSEC chains" [1].  Basically, you write a file with all the DNS 
records you need to chain back from some record to the root.  I wonder 
if this would be a nice format for the .well-known proof type.

For domains that support DNSSEC, at least to the level of having a DS, 
this approach has the advantage of not depending on HTTPS for security. 
  After all, relying on HTTPS for our proof type is just kicking the can 
from a domain where we're not comfortable with hosting providers having 
certs in their clients' names (XMPP) to one where we are (HTTP).

Domains that don't support DNSSEC won't be able to construct a chain all 
the way back to the root, but it seems like we could specify that in 
that case, you just provision the chain as far up as you can (or just 
put in a DANE record), and rely on HTTPS.  At least it provides a smooth 
path forward as more people deploy DNSSEC.

And in any case, there are already open-source encoding and validation 
tools available [2].

Just a thought,
--Richard



[1] <http://tools.ietf.org/html/draft-agl-dane-serializechain-01>
[2] <http://www.imperialviolet.org/2011/06/16/dnssecchrome.html>