Re: [dnsext] DTLS alternative to DNS-Curve

[Phillip Hallam-Baker <[e-mail]>]

It certainly works for updates and there is certainly a delta required to
use it for requests. My starting point for doing all this stuff was looking
at TKEY.

Now whether it is better to build on TKEY/GSSAPI or TLS/Ticket is something
we can argue about later. It is not out of the bounds of possibility that we
might want both. One of the problems of using DNS for anything at this point
is that some networks have firewalls that filter the DNS traffic and some
broadband providers intercept and redirect DNS traffic.


I think we probably agree that we can meet our requirements for servicing
client requests without going to DNSCurve and introducing a completely new
raft of crypto.


On Thu, Sep 16, 2010 at 3:05 PM, Tony Finch <[e-mail]> wrote:

> On Thu, 16 Sep 2010, Phillip Hallam-Baker wrote:
>
> > I think it would take a huge amount of effort to get RFC 2930 into an
> > acceptable state. It is ten years old and like many other DNSSEC drafts
> of
> > that vintage rather vague on details.
> >
> > http://tools.ietf.org/html/rfc2930
> >
> > This is really not much more than a RR format with a vague suggestion to
> use
> > GSSAPI.
>
> It is widely deployed:
> http://technet.microsoft.com/en-us/library/cc961412.aspx
>
> It does need extending to secure queries (as well as / instead of updates)
> and to work outside the context of a kerberos realm.
>
> Tony.
> --
> f.anthony.n.finch  <[e-mail]>  http://dotat.at/
> HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO
> 7,
> DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
> ROUGH. RAIN THEN FAIR. GOOD.
>



-- 
Website: http://hallambaker.com/