[DNSOP] Re: [art] Re: DNS-designated Public Key Author ities (DKA)

On Thu, Jun 25, 2026 at 1:44 PM S Kishore <[email protected]> wrote:
...
> The moment you put a DKA designation in a https URL, you don’t know what the URL serves whom.

I think you're describing a version of the "key consistency" problem.
DNS does not offer any consistency guarantee (and indeed,
authoritative DNS servers routinely serve different answers to
particular resolvers).  Luckily, there are several good ways to ensure
consistency, when the underlying protocol does not guarantee it:
https://datatracker.ietf.org/doc/html/draft-ietf-privacypass-key-consistency-01

...
> It is no-longer an arms-length relationship.

Arms-length relationship, by indirection to some mutually trusted
party, can certainly be achieved via HTTP (or any other transport
protocol).  However, I don't think it's very coherent in this
situation.  The ownership of each email address on some domain is
determined exclusively by the domain operator.  If it decides to claim
one of those addresses for its own use, in whole or in part, it is
free to do so.

> If you have followed the OpenPGP debates over the years, transparency of key discovery has always been a major theme.

Absolutely, but that work should go to KEYTRANS.

...
> Pushing important decisions
> about trust levels out to the relying parties does not work well in
> practice.
>
> Answer: Do you have any specific examples or case studies?

The example on my mind is the Web PKI, where the DV/OV/EV trust
hierarchy has effectively collapsed to just one level.

> Ben > My preference would be to eliminate this TXT record from the design entirely.
>
> Answer: I am not in love with TXT records, but they have evolved to have no semantics

My concern is not about the RR type.  My concern is about the loss of
security from an indirection that is highly vulnerable to attack.

BTW, another line of attack: an attacker operating a pass-through DKA
could mount a significant "passive" attack, determining the metadata
of communication without modifying any requests or responses.

--Ben

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]