Re: PKS, and the DV/MD choice...

[Mathew Lodge <[e-mail]>]

Christian Huitema wrote:
>So, we want secure connectivity information, saying essentially that "net
>X is connected to AS Y".  One option is to modify BGP-6 to carry
>certificates. But this is overkill -- the connectivity information is
>static, about as static as address assignment.  Why not just place it in
>the DNS ? The inverse domains can be secured by DNS sec, with delegation
>traceable all the way up to the IANA.  We could easily place an AS record
>in that hierarchy, e.g. "*.18.in-addr.arpa AS IN 12345".  That would allow
>instant checks by just looking in the DNS, and a path to escalation in
>paranoia land for the security conscious.

This would be fine but for the fact that changes to DNS delegations are not
authenticated themselves. As an example, when working for my previous
employer, the tier-1 ISP providing one of our Internet links told the
InterNIC that it ran primary DNS for our domains. Needless to say, it did
not, but no-one bothered to check. The lack of information in this ISP's
DNS files about our hosts and networks effectively "removed" us from the
Internet for several days, until the correct DNS information was propagated
back out into the Internet.

So, even if you have delegation traceable back to IANA... who's to say that
the correct delegators are members of the chain? The tier-1 ISP could have
signed its DNS information, which would have made it authenticated as far
as DNS sec is concerned -- but it still would have been bogus info.

Mathew
| Mathew Lodge, Product Manager, Cisco Systems  |
| [e-mail]; Phone: [phone]      |
| Fax: [phone]				|