Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

[Roy Arends <[e-mail]>]

On Thu, 5 Apr 2001, John Gilmore wrote:

> > For host with an A RR that points to the zone-name (instead of
> > a hostname under the zone-name) and without any knowledge, this
> > clash could happen, but then two unlikely things are happening
> > (a system administrator putting his "ipsec/ssh" host at the
> > top of his zone and a user whois aware of ipsec/ssh but unaware
> > of where to look for the ipsec/ssh key-RR).
> 
> There's nothing wrong with putting an IPSEC KEY record at the top
> of a zone, along with the zone keys.  That's why the keys have flags
> and protocol fields in them, to differentiate the various sorts that
> a domain name or host might have.

There is nothing wrong with putting IPSEC KEY's in a zone. Just not at the
apex. I rather want the zone to be responsible for the SIG(IPSEC KEY) than
the Parent zone, which is out of my control. Next to that, a ZONE key is
responsible for the whole zone, while IPSEC KEY's are associated with
individual hostnames or numbers. 

I agree with Randy's statement that "in general, we discourage storing
non-dns data in the dns.", but thats in my view unrelated to this matter.
The DNS is an excellent place to store IPSEC Keys. I strongly encourage
using DNS as a PKI (which DNSSEC is), when it comes to these DNS related
matters. If one uses DNSSEC to authenticate data which is responsible for
mapping hostnames to numbers, why not authenticate data which is
responsible for mapping hostkeys to numbers (or vice versa). If I think
about it a little further, I can see those as strongly related: DNSSEC for
authentication, IPSEC for encryption. Where is IPSEC without DNSSEC. And
what else is there to use for IPSEC key distribution ? Where is the
redundant, globally distributed and widely used X-509 PKI scheme for that
matter ?

Regards,

Roy Arends
Nominum.








to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.