<html><head></head><body><div><div><div class=""><div class=""><div class=""><div class=""><br></div></div><br><div class="sh-signature"><div class="gmail_signature"><br></div></div></div><br><div class="sh-quoted-content"><div class=""><div class="gmail_quote">On Wed, Feb 26, 2025 at 1:00 PM, Phillip Hallam-Baker <span dir="ltr" class=""><<a href="mailto:phill@hallambaker.com" target="_blank" class="">phill@hallambaker.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><div dir="ltr" class=""><div style="font-size:small" class="gmail_default">I am currently taking a hard look at mechanisms for using DNS Handles as a means for exchange of authenticated and non-authenticated contact information via JSContact.<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">As part of that, I wanted to know if there was any *existing* use of the SSHFP record for publishing SSH credentials and if so whether it was limited to the server. And yes, I can read the specs, what I am asking about is actual practice.<br></div></div></div></div></blockquote></div></div></div></div><div class=""><div class=""><br></div><div class=""><br></div><div class="">I had been using SSHFP records, but eventually stopped.<br></div><div class="">I was managing my machines using Puppet and used the 'facts2sshfp' script ( <a href="https://github.com/jpmens/facts2sshfp">https://github.com/jpmens/facts2sshfp</a>) to automatically extract and publish these. <br></div><div class="">Eventually I migrated all of my automation to Ansible, and never really got around to re-doing the SSHFP record generation.<br></div><div class=""><br></div><div class="">They did work fairly well, but seeing as I'm basically the only user of my machines, I've "solved" the issue through the following rigorous process:<br></div><div class=""><br></div><div class="">If ssh client prompts me for a fingerprint, I go:<br></div><div class="">1: "Huh? Ah, yes, this is the first time I'm connecting to this server from this client… I should go check if the finge.. meh, 'tis probably fine…."<br></div><div class="">or<br></div><div class="">2: "Huh?! Oh, yes, I *just* reinstalled this machine… Someone could be arp-spoofing the address on my LAN and… meh, 'tis probably fine…."<br></div><div class=""><br></div><div class="">W</div><div class=""><br></div><div class="sh-quoted-content"><div class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><div dir="ltr" class=""><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">If there is existing use, it might be something to build on. Otherwise, I think it best to forget it and apply the same SRV/TXT framework used for everything else.<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">The basic idea of JSContacts in handles being that I can put @<a href="http://phill.hallambaker.com" target="_blank" rel="noopener noreferrer" class="">phill.<wbr>hallambaker.<wbr>com</a> on my business card or a publication, someone can pull the TXT record and get a uri that is a locator, decryptor and authenticator all in one:<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">_<a href="http://jscontact.phill.hallambaker.com" target="_blank" rel="noopener noreferrer" class="">jscontact.<wbr>phill.<wbr>hallambaker.<wbr>com</a>. IN TXT "uri=jscontact://<a target="_blank" rel="noopener noreferrer" href="http://mplace2.social/egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq" class="">mplace2.<wbr>social/<wbr>egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq</a>"<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">That egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq bit is a truncated SHA-3 digest of the contact data. So if my SSH key is in the contact and the TXT record is DNSSEC signed, we have at least some authentication of the contact.<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">Alternatively, I might put the jscontact link on my business card as a QR code. So now, you can scan the link and get direct verification.<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default"><a target="_blank" rel="noopener noreferrer" href="http://mplace2.social/" class="">mplace2.<wbr>social</a> is just a resolution hint, a domain that currently has the contact information. If that is going to be in a paper publication, the resolution site might have changed but not the contact itself.<br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">jscontact: @<a href="http://phill.hallambaker.com/egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq" target="_blank" rel="noopener noreferrer" class="">phill.<wbr>hallambaker.<wbr>com/<wbr>egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq</a><br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default"><br></div><div style="font-size:small" class="gmail_default">Since my publication engine has to populate the TXT records, it can do SSHFP in theory. But I see no reason to do that if it hasn't already established a user base.<br></div></div><div>
<br></div><p class="">_______________________________________________
<br>
dns-operations mailing list
<br>
<a target="_blank" rel="noopener noreferrer" href="mailto:dns-operations@lists.dns-oarc.net" class="">dns-operations@<wbr>lists.<wbr>dns-oarc.<wbr>net</a>
<br>
<a target="_blank" rel="noopener noreferrer" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" class="">https:/<wbr>/<wbr>lists.<wbr>dns-oarc.<wbr>net/<wbr>mailman/<wbr>listinfo/<wbr>dns-operations</a></p></div></div></blockquote></div></div></div><div><br></div></div><div><br></div></div><div></div></div></body></html>