Re: [dbound] draft-brotman-rdbd

[Stephen Farrell <[e-mail]>]

Hi John,

On 31/03/2019 23:29, John R. Levine wrote:
>> 1.
>>> We include an optional digital signature mechanism...
>> why optional? without any signature wouldn't it possible to any third
>> party to express any relationship?
> 
> Don't really understand this question, but see my prior messages about
> the threat model.  I have yet to understand what problem the signatures
> solve, that couldn't be addressed more simply by putting records at the
> relating and related domains that point at each other.

Fair enough. I've also yet to understand what's not clear about that,
but happy to try again, using a permutation of earlier words:-)

If the public key is available with integrity (either via DNSSEC for
the relating domain or via caching) then signatures add some evidence
that the relationship is real.

Cheers,
S.

PS: I figure I agree with the rest you wrote below.


>>> RDBD is intended to demonstrate a relationship between registered
>>> domains, not individual hostnames.
>>
>> where is the border? May publicsufficlist help defining them?
> 
> Presumably one would use the PSL to find the appropriate places to look.
> 
>> 2.1 / 2.2
>> as zone apex is likely to be overloaded today, defining something like
>> _drbd.example covering RDBDKEY and RDBD data comes in mind.
> 
> Since the records have new rrtypes, I don't understand what you mean by
> "overloaded".  Underscore prefixes are mostly for TXT records and these
> are not TXT records.
> 
> Regards,
> John Levine, [e-mail], Primary Perpetrator of "The Internet for
> Dummies",
> Please consider the environment before reading this e-mail. https://jl.ly
> 
> _______________________________________________
> dbound mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dbound
>