Subject: [Asrg] 6. Solutions - Based on Digital Certificates

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 09 Jul 2003 02:32:36 -0400

I read over RFC 2538 which specifies a way for digital certificates to be 
stored in the DNS system. The RFC seems to support both X.509 and PGP 
certs. Could the method defined in that RFC be used to verify a sender's 
identity by storing his certificate in the DNS for the originating domain?

Yakov 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Raymond S Brand <[email-masked]>
Date: Wed, 09 Jul 2003 11:16:54 -0400

> identity by storing his certificate in the DNS for the originating domain?

Unfortunately, the DNS based CERT storage system proposed in RFC2538 is
not efficient for lookups if the type, key tag, or algorithm fields are
used as part of the lookup. That is because those fields are in the data
returned for a lookup, not the (DNS name) lookup key. So if John Q Public
has several CERTs, anyone needing a particular one will need to retrieve
them all to find the one with the correct type, key tag, and/or algorithm
fields.

The problem can be overcome by encoding the CERT selection information as
sub-domain labels to the FQDN for John Q Public. DRIP does something like
this to check for designation records for SMTP transactions. See

	http://ietf.org/internet-drafts/draft-brand-drip-00.txt

Raymond S Brand