Subject: DNSSEC in conjunction with mDNS+DNS-SD

From: Federico Lucifredi <[email-masked]>
Date: Sun, 10 Jun 2007 10:51:31 -0400

Hello namedroppers,
 I was wondering if any published work exists on the use of DNSSEC in
conjunction with the set of protocols collectively known as "Apple
Bonjour" (mDNS, DNS-SD, etc).

 Best -Federico

-- 

_________________________________________
-- "'Problem' is a bleak word for challenge" - Richard Fish
(Federico L. Lucifredi) - http://www.lucifredi.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 11 Jun 2007 10:32:50 +0200

On Sun, Jun 10, 2007 at 10:51:31AM -0400,
 Federico Lucifredi <[email-masked]> wrote 

> Bonjour" (mDNS, DNS-SD, etc).

Hmm, for non-IETF protocols? I doubt it since there is an IETF
protocol in this area, LLMNR (RFC 4795).

This RFC says, in 5.3 "Authentication":

   (c)  LLMNR implementations MAY support DNSSEC [RFC4033].  In order to
        support DNSSEC, LLMNR implementations MAY be configured with
        trust anchors, or they MAY make use of keys obtained from DNS
        queries.  Since LLMNR does not support "delegated trust" (CD or
        AD bits), LLMNR implementations cannot make use of DNSSEC unless
        they are DNSSEC-aware and support validation.  Unlike approaches
        [a] or [b], DNSSEC permits a responder to demonstrate ownership
        of a name, not just membership within a trusted group.  As a
        result, it enables protection against forgery.

---

From: Danny Mayer <[email-masked]>
Date: Mon, 11 Jun 2007 12:36:56 -0400

> Bonjour" (mDNS, DNS-SD, etc).

Since they're unrelated I'm not sure what your question means.

Danny

---

From: Danny Mayer <[email-masked]>
Date: Sun, 10 Jun 2007 14:17:48 -0400

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

Danny

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 12 Jun 2007 09:06:16 +0200

On Mon, Jun 11, 2007 at 12:36:56PM -0400,
 Danny Mayer <[email-masked]> wrote 

> Since they're unrelated I'm not sure what your question means.

He probably wanted to use DNSSEC to authenticate responses coming from
Apple's proprietary mDNS protocol. 

AFAIK, there is nothing, but you may start from the note in RFC 4795
that I mentioned? It could work with mDNS, too, but it may be
difficult, since the pseudo-TLD ".local" is shared by everyone.

---

From: Federico Lucifredi <[email-masked]>
Date: Tue, 12 Jun 2007 10:15:50 -0400

> protocol in this area, LLMNR (RFC 4795).
My understanding is that LLMNR was *rejected* as a proposed standard,
and published as an informational RFC, which is the same status mDNS and
DNS-SD will eventually enjoy (rejected as proposed standard, to be
published later as informational - with later meaning "after OS-X ships").

Best -F

--

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 12 Jun 2007 16:52:47 +0200

On Tue, Jun 12, 2007 at 10:15:50AM -0400,
 Federico Lucifredi <[email-masked]> wrote 
 a message of 26 lines which said:

> which is the same status mDNS and DNS-SD will eventually enjoy

It is difficult to foresee the future. As of today, there is no active
Internet-Draft about mDNS or DNS-SD. (There was but they all expired.)

---

From: Paul Vixie <[email-masked]>
Date: Tue, 12 Jun 2007 16:03:40 +0000

> Internet-Draft about mDNS or DNS-SD. (There was but they all expired.)

do you expect that apple could get informational status rfc's if they asked?

---

From: Federico Lucifredi <[email-masked]>
Date: Tue, 12 Jun 2007 12:58:01 -0400

> do you expect that apple could get informational status rfc's if they asked?
Well, as it was pointed out, the future is hard to predict.

For one, mDNS, DNS-SD, etc have been in the RFC process for years, and
there has a large installed base and considerable experience in using
it. Lets not forget, LLMNR was approved as informational a couple of
years back with much less (of course, now there is Vista).

Best -F

--