Subject: [Trans] DNS for CT

From: Ben Laurie <[email-masked]>
Date: Tue, 23 Feb 2016 16:00:42 +0000

As we've mentioned several times, we've been working on a way to retrieve
CT data over DNS to improve the privacy properties of inclusion proofs.

So, I'm pleased to announce that we now have a test DNS service up for some
of our logs.

The documentation for the protocol can be found here:

https://github.com/google/certificate-transparency-rfcs/blob/master/dns/draft-ct-over-dns.md

The base domains for the supported logs are:

aviator.ct.googleapis.com
pilot.ct.googleapis.com
testtube.ct.googleapis.com

and a demo showing use of the DNS records is here:

https://github.com/google/certificate-transparency/blob/master/python/utilities/dnslookup/dnslookup.py

The demo is pretty primitive, but does show all the things you can get from
the DNS.

Comments and improvements welcome.

---

From: "Paul Hoffman" <[email-masked]>
Date: Tue, 23 Feb 2016 16:12:09 -0800

> CT data over DNS to improve the privacy properties of inclusion 

This is a good idea, and the motivation mentioned in the not-yet-a-draft 
is good. However, I have some questions about the protocol that you 
show.

> https://github.com/google/certificate-transparency-rfcs/blob/master/dns/draft-ct-over-dns.md

1) Why do you create a new Opcode for the header? These are kind of 
precious values. You are already using prefixes on the QNAME for STH 
queries; you could easily do so for the others as well.

2) Standard practice these days is to have prefixed labels start with an 
underscore (_).

3) In the STH Query example, the Question section in the response is 
different than the Question section in the request. I hope this is a 
typo, given that RFC 1034 says that the two must be the same.

4) If you sure that the RData values for the responses are less than 256 
characters, that's fine; if they can be longer than that, you should 
probably add a note about the TXT records having more than one 
character-data string.

--Paul Hoffman

---

From: Ben Laurie <[email-masked]>
Date: Wed, 24 Feb 2016 05:06:15 +0000

On 24 February 2016 at 00:12, Paul Hoffman <[email-masked]> wrote:

> is good. However, I have some questions about the protocol that you show.
>
>

I don't think that was intentional - we're not actually using a different
opcode!

> 2) Standard practice these days is to have prefixed labels start with an

You mean like in SRV records? It wasn't particularly intended that these
would be on a domain used for anything other than CT... but no particular
objection, either.

> different than the Question section in the request. I hope this is a typo,
> given that RFC 1034 says that the two must be the same.
>

It is.

> probably add a note about the TXT records having more than one

We were trying to avoid that happening...

---

From: Ben Laurie <[email-masked]>
Date: Wed, 24 Feb 2016 14:10:24 +0000

All these should be fixed now.