Subject: [xmpp] Fwd: New Version Notification for draft-barnes-xmpp-dna-00

From: "Richard L. Barnes" <[email-masked]>
Date: Thu, 19 Aug 2010 17:31:39 -0400

Hey all,

After the DNA presentation I did at the last IETF, I promised to write  
an I-D describing the different options and their trade-offs.  The  
document is now available on the IETF website:
<http://www.ietf.org/id/draft-barnes-xmpp-dna-00.txt>

The document lays out a general process for authenticating inter- 
domain delegations, and explores some options for how the specifics  
can work.

Based on the trade-offs discussed in the document, my current favorite  
solution is to take a pure DNS approach, signing SRV records with  
DNSSEC and embedding DNSSEC trust anchors in CERT records alongside  
the SRV records (Corresponding to sections 4.1 and 5.2 in the  
document).  This is basically the same system I described in  
Maastricht, with the modification that instead of being passed in the  
XMPP channel, the certificates are provisioned in the DNS so that the  
client can look them up and validate the delegation before connecting.

Comments welcome,
--Richard

Begin forwarded message:

> From: IETF I-D Submission Tool <[email-masked]>
> Date: August 19, 2010 5:26:45 PM EDT
> To: [email-masked]
> Subject: New Version Notification for draft-barnes-xmpp-dna-00
>
>
> A new version of I-D, draft-barnes-xmpp-dna-00.txt has been  
> successfully submitted by Richard Barnes and posted to the IETF  
> repository.
>
> Filename:	 draft-barnes-xmpp-dna
> Revision:	 00
> Title:		 Domain Name Assertions
> Creation_date:	 2010-08-19
> WG ID:		 Independent Submission
> Number_of_pages: 13
>
> Abstract:
> Many Internet applications allow service delegation via the DNS.
> However, in the absence of DNSSEC, these delegations are
> unauthenticated, so clients have to authenticate the delegate as if
> he were the original service.  This situation causes several
> operational problems.  This document describes a mechanism for
> clients to discover and validate information that authenticates DNS-
> based service delegations, without relying on the global deployment
> of DNSSEC.
>
>
>
> The IETF Secretariat.
>
>