Subject: Re: Global PKI on DNS?

From: "Steven M. Bellovin" <[email-masked]>
Date: Sat, 08 Jun 2002 09:22:54 -0400

In message <[email-masked]>, Franck Martin write
s:
>
>--=-1oDXxRUK6t5l82vmGc/e
>Content-Type: text/plain
>Content-Transfer-Encoding: 7bit
>
>Here is a sample certificate... which is less than 2kB long...
>
>DNS protocol uses mainly udp, which I think can handle this size...
>
>You can know what it means by using the command (I think):
>

DNS packets are limited to 512 bytes.  Few MTUs are larger than 1500.

Anyway -- the concept is called "appkeys", and has been discussed in 
the dnsext working group.  Check the archives.

Oh yes -- x.509 isn't the only way to do certificates.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

---

From: Mats Dufberg <[email-masked]>
Date: Sat, 8 Jun 2002 15:49:03 +0200 (CEST)

> DNS packets are limited to 512 bytes.  Few MTUs are larger than 1500.

If the response requires a larger packet, the query has to be repeated
with TCP, which is more costly.

> Oh yes -- x.509 isn't the only way to do certificates.

For certificates you could use CERT records.

Mats

----------------------------------------------------------------------
Mats Dufberg <[email-masked]>
----------------------------------------------------------------------

---

From: David Conrad <[email-masked]>
Date: Sat, 08 Jun 2002 13:35:42 -0700

On 6/8/02 6:22 AM, "Steven M. Bellovin" <[email-masked]> wrote:
> DNS packets are limited to 512 bytes.

No they are not.  They are limited to 64K.  Even without EDNS0, a large
response can fall back to TCP.  You know this.

> Few MTUs are larger than 1500.

What is the average size of a CERT (honest question, I have no idea)?

> the dnsext working group.  Check the archives.

I thought APPKEY was addressing putting non-self-validating keys into the
DNS, relying on DNSSEC to insure a chain of trust.

Rgds,
-drc