Re: Autonomous System Sanity Protocol

[Jeremy Porter <[e-mail]>]

In message <[e-mail]>, Bill Manning writes:
>> 
>> However, if we assume that the basic protocol machinery is correct and are
>> out to protect us against ourselves, the delegation problem is the correct
>> one to solve.  Note that any practical solution probably requires some type
>> of key management solution already deployed.  One then needs to be able to
>> see a hierarchy of signed and trusted address space delegations.
>> 
>> Tony
>
>
>Humm, perhaps a first, rough cut might be turning on DNS Security for the
>inverse delegations all the way down.  That way you could get a "chain of
>custody" for the authoritative delegations.  You could also discriminate
>proxy aggregations... :)
>--bill

I'm not sure if/what your joking about, but I sure wouldn't trust
inverse delegations to be correct, with companies out on the net
deleting delegations in excess of their real authority.  Of course
if you did this at least you wouldn't have to worry about be routing
addresses where the in-addr.arpa's wern't correctly delegated...

The question with regard to trusted agencies is a real problem,
and apparently one of the ones that still hasn't been solved.


---
Jeremy Porter, Freeside Communications, Inc.      [e-mail]
PO BOX 80315 Austin, Tx 78708  |  1-800-968-8750  |  512-458-9810
http://www.fc.net