Re: [dnsext] slave signing, was does making names the same NEED protocol changes at all?

[Phillip Hallam-Baker <[e-mail]>]

Two questions come to mind

1) How is key publication going to be effected for rDNS-SEC?

Have we actually got a plan for deployment?


2) If we have a viable plan for deployment of rDNS-SEC, why would we not
plan to use that as the PKI for BGPSEC?

It may make sense to employ a hybrid PKI since DNSSEC responses are
transitory and there is a bootstrap issue. But this makes more sense to me
than experimenting with novel X.509 features.


On Sun, Feb 27, 2011 at 12:05 AM, John Levine <[e-mail]> wrote:

> >Requiring slaves to be signers is a major change to the security model.
>
> Maybe, but this isn't the only place it's an issue.
>
> IPv6 rDNS is a can of worms that I'd prefer not to open here, but
> making forward and reverse DNS match on consumer IPv6 is another
> problem that has no straightforward solution.  One of the possiblities
> that keeps coming up is stunt servers that synthesize the records as
> needed, which obviously means that if they do DNSSEC they need to have
> the signing keys.
>
> R's,
> John
>



-- 
Website: http://hallambaker.com/