5 ms·
>A TLS server supporting ECH now advertises its public key via an HTTPSSVC DNS record Why a new record type, when TLSA records were invented for literally this
by parliament32 6y ago
>A TLS server supporting ECH now advertises its public key via an HTTPSSVC DNS record
Why a new record type, when TLSA records were invented for literally this exact purpose?
- pas 6y agoBecause it's like TLSA + SRV [which itself is basically CNAME + a port hint] + A + AAAA in one. (Because there's no "consistent multi querying" in DNS, so it had to be basically multiplexed into one RR type.) https://blog.cloudflare.com/speeding-up-https-and-http-3-negotiation-with-dns/ https://blog.cloudflare.com/speeding-up-https-and-http-3-neg...
- snuxoll 6y agoOkay, I can see why this new record type would be beneficial given the lax consistency model of DNS - seems a little lame to make the record type ‘HTTPSVC’ given that other TLS-enabled services could benefit from the same guarantees.
- teddyh 6y agoAs I understand it, the new record types are “HTTPS” and “SVCB” (“service binding”). The SVCB record is a generic SRV-like thing, and HTTPS is like SVCB but with extra things which HTTPS needs.
- tialaramex 6y agoYou want to bundle the entire configuration, because DNS doesn't provide any consistency guarantee between records.