draft-ietf-dnssec-ddi-02.txt   draft-ietf-dnssec-ddi-03.txt 
INTERNET-DRAFT Donald E. Eastlake 3rd INTERNET-DRAFT Donald E. Eastlake 3rd
CyberCash, Inc. CyberCash, Inc.
Expires July 1998 January 1998
Detached Domain Name System Information Detached Domain Name System (DNS) Information
-------- ------ ---- ------ ----------- -------- ------ ---- ------ ----- -----------
Donald E. Eastlake 3rd Donald E. Eastlake 3rd
Status of This Document Status of This Document
This draft, file name draft-ietf-dnssec-ddi-02.txt, is intended to be This draft, file name draft-ietf-dnssec-ddi-03.txt, is intended to be
become a Proposed Standard RFC. Distribution of this document is become a Proposed Standard RFC. Distribution of this document is
unlimited. Comments should be sent to the DNS Security Working Group unlimited. Comments should be sent to the DNS Security Working Group
mailing list <dns-security@tis.com> or to the author. mailing list <dns-security@tis.com> or to the author.
This document is an Internet-Draft. Internet-Drafts are working This document is an Internet-Draft. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas, documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts. working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six Internet-Drafts are draft documents valid for a maximum of six
skipping to change at page 3, line 12 skipping to change at page 3, line 12
Author's Address...........................................8 Author's Address...........................................8
Expiration and File Name...................................8 Expiration and File Name...................................8
1. Introduction 1. Introduction
The Domain Name System (DNS) is a replicated hierarchical distributed The Domain Name System (DNS) is a replicated hierarchical distributed
database system [RFC 1034, 1035] that can provide highly available database system [RFC 1034, 1035] that can provide highly available
service. It provides the operational basis for Internet host name to service. It provides the operational basis for Internet host name to
address translation, automatic SMTP mail routing, and other basic address translation, automatic SMTP mail routing, and other basic
Internet functions. The DNS has recently been extended as described Internet functions. The DNS has recently been extended as described
in RFC 2065 to permit the general storage of public cryptographic in [RFC 2065] to permit the general storage of public cryptographic
keys in the DNS and to enable the authentication of information keys in the DNS and to enable the authentication of information
retrieved from the DNS though digital signatures. retrieved from the DNS though digital signatures.
The DNS was not originally designed for storage of information The DNS was not originally designed for storage of information
outside of the active zones and authoritative master files that are outside of the active zones and authoritative master files that are
part of the connected DNS. However there may be cases where this is part of the connected DNS. However there may be cases where this is
useful, particularly in connection with security information. useful, particularly in connection with security information.
2. General Format 2. General Format
The formats used for detached Domain Name System (DNS) information The formats used for detached Domain Name System (DNS) information
are similar to those used for connected DNS information. The primary are similar to those used for connected DNS information. The primary
difference is that elements of the connected DNS system (unless they difference is that elements of the connected DNS system (unless they
are an authoritative server for the zone containing the information) are an authoritative server for the zone containing the information)
are required to count down the Time To Live (TTL) associated with are required to count down the Time To Live (TTL) associated with
each DNS Resource Record (RR) and discard them (possibly fetching a each DNS Resource Record (RR) and discard them (possibly fetching a
fresh copy) when the TTL reaches zero. Since detached information fresh copy) when the TTL reaches zero. In contrast to this, detached
may be stored in a file or received via non-DNS protocols long after information may be stored in a off-line file, where it can not be
it was retrieved from the DNS, it is not practical to count down its updated, and perhaps used to authenticate historic data or it might
TTL and it may be necessary to keep the data beyond the point where be received via non-DNS protocols long after it was retrieved from
the TTL (which is defined as an unsigned field) would underflow. To the DNS. Therefore, it is not practical to count down detached DNS
preserve information as to the freshness of this detached data, it is information TTL and it may be necessary to keep the data beyond the
accompanied by its retrieval time. point where the TTL (which is defined as an unsigned field) would
underflow. To preserve information as to the freshness of this
detached data, it is accompanied by its retrieval time.
Whatever retrieves the information from the DNS must associate this Whatever retrieves the information from the DNS must associate this
retrieval time with it. The retrieval time remains fixed thereafter. retrieval time with it. The retrieval time remains fixed thereafter.
When the current time minus the retrieval time exceeds the TTL for When the current time minus the retrieval time exceeds the TTL for
any particular detached RR, it is no longer a valid copy within the any particular detached RR, it is no longer a valid copy within the
normal connected DNS scheme. This may make it invalid in context for normal connected DNS scheme. This may make it invalid in context for
some detached purposes as well. If the RR is a SIG (signature) RR it some detached purposes as well. If the RR is a SIG (signature) RR it
also has an expiration time. Regardless of the TTL, it and any RRs also has an expiration time. Regardless of the TTL, it and any RRs
it signs can not be considered authenticated after the signature it signs can not be considered authenticated after the signature
expiration time. expiration time.
skipping to change at page 5, line 22 skipping to change at page 5, line 22
/ / / /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| next retrieval time | | next retrieval time |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| RR count | | | RR count | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Resource Records (RRs) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Resource Records (RRs) |
/ / / /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ ... / / ... /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ hex 80 | | hex 80 |
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
Retrieval time - the time that the immediately following information Retrieval time - the time that the immediately following information
was obtained from the connected DNS system. It is an unsigned was obtained from the connected DNS system. It is an unsigned
number of seconds since the start of 1 January 1970, GMT, ignoring number of seconds since the start of 1 January 1970, GMT, ignoring
leap seconds, in network (big-endian) order. Note that this time leap seconds, in network (big-endian) order. Note that this time
can not be before the initial proposal of this standard. can not be before the initial proposal of this standard.
Therefore, the initial byte of an actual retrieval time, Therefore, the initial byte of an actual retrieval time,
considered as an unsigned quantity, will be larger than 80 hex. considered as an unsigned quantity, will be larger than 80 hex.
The end of detached DNS information is indicated by a "retrieval The end of detached DNS information is indicated by a "retrieval
skipping to change at page 6, line 8 skipping to change at page 6, line 8
Resource Records - the actual data which is in the same format as if Resource Records - the actual data which is in the same format as if
it were being transmitted in a DNS response. In particular, name it were being transmitted in a DNS response. In particular, name
compression via pointers is permitted with the origin at the compression via pointers is permitted with the origin at the
beginning of the particular detached information data section, beginning of the particular detached information data section,
just after the RR count. just after the RR count.
2.2. Text Format 2.2. Text Format
The standard text format for detached DNS information is as The standard text format for detached DNS information is as
prescribed for zone master files (see RFC 1035) except that the prescribed for zone master files [RFC 1035] except that the $INCLUDE
$INCLUDE control entry is prohibited and the new $DATE entry is control entry is prohibited and the new $DATE entry is required
required (unless the information set is empty). $DATE is followed by (unless the information set is empty). $DATE is followed by the date
the date and time that the following information was obtained from and time that the following information was obtained from the DNS
the DNS system as described for retrieval time in section 2.1 above. system as described for retrieval time in section 2.1 above. It is
It is in the text format YYYYMMDDHHMMSS where YYYY is the year, the in the text format YYYYMMDDHHMMSS where YYYY is the year, the first
first MM is the month number (01-12), DD is the day of the month MM is the month number (01-12), DD is the day of the month (01-31),
(01-31), HH is the hour in 24 hours notation (00-23), the second MM HH is the hour in 24 hours notation (00-23), the second MM is the
is the minute (00-59), and SS is the second (00-59). Thus a $DATE minute (00-59), and SS is the second (00-59). Thus a $DATE must
must appear before the first RR and at every change in retrieval time appear before the first RR and at every change in retrieval time
through the detached information. through the detached information.
3. Usage Example 3. Usage Example
A document might be authenticated by a key retrieved from the DNS in A document might be authenticated by a key retrieved from the DNS in
a KEY resource record (RR). To later prove the authenticity of this a KEY resource record (RR). To later prove the authenticity of this
document, it would be desirable to preserve the KEY RR for that document, it would be desirable to preserve the KEY RR for that
public key, the SIG RR signing that KEY RR, the KEY RR for the key public key, the SIG RR signing that KEY RR, the KEY RR for the key
used to authenticate that SIG, and so on through SIG and KEY RRs used to authenticate that SIG, and so on through SIG and KEY RRs
until a well known trusted key is reached, perhaps the key for the until a well known trusted key is reached, perhaps the key for the
DNS root or some third party authentication service. (In some cases DNS root or some third party authentication service. (In some cases
these KEY RRs will actually be sets of KEY RRs with the same owner these KEY RRs will actually be sets of KEY RRs with the same owner
and class because SIGs actually sign such record sets.) and class because SIGs actually sign such record sets.)
This information could be preserved as a set of detached DNS This information could be preserved as a set of detached DNS
information blocks. information blocks.
4. Security Considerations 4. Security Considerations
The entirety of this document concerns a means to represent detached The entirety of this document concerns a means to represent detached
DNS information. Security considerations are not covered in this DNS information. Such detached resource records may be security
draft. Such detached information may be security relevant resource relevant and/or secured information as described in RFC 2065. The
records as described in RFC 2065. detached format provides no overall security for sets of detached
information or for the association between retrieval time and
information. This can be provided by wrapping the detached
information format with some other form of signature. However, if
the detached information is accompanied by SIG RRs, its validity
period is indicated in those SIG RRs so the retrieval time might be
of secondary importance.
References References
[RFC 1034] - Domain Names - Concepts and Facilities, P. Mockapetris, [RFC 1034] - Domain Names - Concepts and Facilities, P. Mockapetris,
November 1987. November 1987.
[RFC 1035] - Domain Names - Implementation and Specifications, P. [RFC 1035] - Domain Names - Implementation and Specifications, P.
Mockapetris, November 1987. Mockapetris, November 1987.
[RFC 2065] - Domain Name System Security Extensions, D. Eastlake, C. [RFC 2065] - Domain Name System Security Extensions, D. Eastlake, C.
Kaufman, January 1997. Kaufman, January 1997.
Author's Address Author's Address
Donald E. Eastlake 3rd Donald E. Eastlake 3rd
CyberCash, Inc. CyberCash, Inc.
318 Acton Street 318 Acton Street
Carlisle, MA 01741 USA Carlisle, MA 01741 USA
Telephone: +1 508 287 4877 Telephone: +1 978 287 4877
+1 508 371 7148(fax)
+1 703 620 4200(main office, Reston, Virginia) +1 703 620 4200(main office, Reston, Virginia)
Fax: +1 978 371 7148
EMail: dee@cybercash.com EMail: dee@cybercash.com
Expiration and File Name Expiration and File Name
This draft expires September 1997. This draft expires July 1998.
Its file name is draft-ietf-dnssec-ddi-02.txt. Its file name is draft-ietf-dnssec-ddi-03.txt.
 End of changes. 12 change blocks. 
28 lines changed or deleted 37 lines changed or added

This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/