Re: [dnsext] Moving policy data away from DNS

The principle objection to putting policy in the DNS seems to be that doing
so represents a slippery slope and that we might end up with people putting
so much information in their DNS that it 'breaks'.

I don't see any reason that the policy information need go beyond that
needed to establish a sufficient connection to negotiate any additional
parameters that might be needed.

So it is not necessary (at present) to say anything more than 'TLS version
1.0 or better always offered, key is X' as far as TLS configuration goes
since TLS has an adequate mechanism for in-band negotiation of cryptographic
parameters once it is known that it is to be used.

It would be very easy to define a property in an extensible mechanism such
as CAA that would allow for linking to an external policy, but I absolutely
do not see any need to do so at present.

On Mon, Dec 27, 2010 at 10:36 AM, Otmar Lendl <lendl@nic.at> wrote:

> On 23.12.2010 03:45, Jay Daley wrote:
> >
> > Say I wanted to state, for host X
> > - here is how hosts that conform to Y should connect to me
> > - here is how hosts that conform to Z should connect to me
> > - here is the default how hosts should connect to me
> > - here is how I intend to connect to hosts that conform to A
> > - and so on
>
> FYI,
>
> I proposed a scheme to solve these a few years ago in the context of SIP
> peering. In hindsight, the proposal was way too ambitious to catch on in
> the speermint WG. It also relies on the DDDS, which has its own problems,
> especially the selector within the RDATA.
>
> If you want to have a look, check out
>
> http://tools.ietf.org/html/draft-lendl-domain-policy-ddds-02
> (the generic framework)
>
> http://tools.ietf.org/html/draft-lendl-speermint-federations-03
> (a use-case for federation-based SIP peering)
>
> http://tools.ietf.org/html/draft-lendl-speermint-technical-policy-00
> (a use-case similar to what you listed)
>
> There is even running code for this:
> http://www.kamailio.org/docs/modules/stable/modules_k/domainpolicy.html
> Look for "Usage Scenarios" to see some examples on what could be done with
> this approach & code.
>
> ----
>
> No, I'm not proposing that this list is taking these drafts up again. I
> just hope that they might inspire some other ideas, and if they are just
> used to fend off IPR claims in the future, I'm also satisfied.
>
> cheers,
>
> otmar
> --
> // Otmar Lendl <lendl@nic.at>, T: +43 1 5056416 - 33, F: - 933 //
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext
>

-- 
Website: http://hallambaker.com/