Speaker
Description
The Domain Name System has traditionally provided a hierarchical namespace for identifying Internet hosts and services. Emerging applications such as drones and IoT devices extend this role beyond conventional Internet resources, requiring not only globally unique identification and resolution, but also new mechanisms to establish trust, such as cryptographically binding an identifier to the entity that owns it.
The IETF Drone Remote ID Protocol (DRIP) is an interesting example of such a namespace. DRIP Entity Tags (DETs) are IPv6-formatted, self-certifying identifiers derived from an entity's public key, organized through a hierarchy of Registered Assigning Authorities (RAAs) and HHIT Domain Authorities (HDAs). DNS and DNSSEC handle the publication, delegation, and authentication of information associated with these identities.
This presentation reports on our implementation of and experimentation with this architecture, including work done during the recent IETF 126 hackathon. We built DET generation and registration, RAA/HDA namespace delegation, DNS and DNSSEC integration, and an end-to-end proof of concept that carries drone identity information from a transmitter to an observer. Working through these pieces lets us go beyond the specifications and see how a namespace like this would actually behave in practice.
DRIP is a concrete case study for a bigger question on how DNS infrastructure and registry practices need to evolve to support namespaces that hold large numbers of cryptographically derived identities for physical devices. We'll cover what we learned from the current proof of concept, where it falls short, and the additional operational and security scenarios that still need to be addressed before something like this could run at Internet scale.
| Talk duration | 20 Minutes (+5 for Q&A) |
|---|
