Nuh 🔻 on Nostr: It maps an ed25519 keys to a DNS packet so a list of records, but that is besides the ...
It maps an ed25519 keys to a DNS packet so a list of records, but that is besides the point.
Let's first consider a simple case where:
1. you lookup `my-app.<A>` (where A is a zbase32 encoded public key) only to find a CNAME record pointing to `hosting-provider.<B>`
2. you lookup `hosting-provider.<B>` to find an A record pointing to the socket address.
What you have heard is a chain of delegation, from the owner of key A to the hosting provider who owns key B.
Well, then we know for a fact that key B should be trusted as an RPK to establish a TLS connection, because Pkarr is already a signed so why not consider it as valid as x.509 certificate chain? only better because the CA in this case is the owner of the TLD (A).
Let's make things a bit more interesting by using HTTPS records instead of CNAME records, because they are more recent and work on APEX domains, and have optional parameters for stuff like ALPN, ECH, port number etc, making establishing HTTP connections more efficient.
HTTPs records are widely supported already, so not too exotic. And I consider them the perfect resource record.
Let's first consider a simple case where:
1. you lookup `my-app.<A>` (where A is a zbase32 encoded public key) only to find a CNAME record pointing to `hosting-provider.<B>`
2. you lookup `hosting-provider.<B>` to find an A record pointing to the socket address.
What you have heard is a chain of delegation, from the owner of key A to the hosting provider who owns key B.
Well, then we know for a fact that key B should be trusted as an RPK to establish a TLS connection, because Pkarr is already a signed so why not consider it as valid as x.509 certificate chain? only better because the CA in this case is the owner of the TLD (A).
Let's make things a bit more interesting by using HTTPS records instead of CNAME records, because they are more recent and work on APEX domains, and have optional parameters for stuff like ALPN, ECH, port number etc, making establishing HTTP connections more efficient.
HTTPs records are widely supported already, so not too exotic. And I consider them the perfect resource record.