IETF Logo Mail Archive

Re: [dnsext] we need help to make names the same, was draft-yao-dnsext-identical-resolution-02 comment

Nicholas Weaver <nweaver@ICSI.Berkeley.EDU> Wed, 23 February 2011 21:48 UTC

Return-Path: <nweaver@ICSI.Berkeley.EDU>
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 567763A6912 for <dnsext@core3.amsl.com>; Wed, 23 Feb 2011 13:48:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ue-xpRIPz6N1 for <dnsext@core3.amsl.com>; Wed, 23 Feb 2011 13:48:15 -0800 (PST)
Received: from taffy.ICSI.Berkeley.EDU (taffy.ICSI.Berkeley.EDU [192.150.187.26]) by core3.amsl.com (Postfix) with ESMTP id 79A973A67F1 for <dnsext@ietf.org>; Wed, 23 Feb 2011 13:48:15 -0800 (PST)
Received: from albook.hsd1.ca.comcast.net (c-67-164-126-174.hsd1.ca.comcast.net [67.164.126.174]) (Authenticated sender: nweaver) by taffy.ICSI.Berkeley.EDU (Postfix) with ESMTP id 19FD836A035; Wed, 23 Feb 2011 13:49:03 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset="us-ascii"
From: Nicholas Weaver <nweaver@ICSI.Berkeley.EDU>
In-Reply-To: <AANLkTin6-mXBeKC_TzgvWUaCyxKfeZxTK1BQvXtpwuCN@mail.gmail.com>
Date: Wed, 23 Feb 2011 13:49:02 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <4CC95816-8225-4CAE-897F-3F13F965BCEE@ICSI.Berkeley.EDU>
References: <20110216165921.GW96213@shinkuro.com> <3B90ED2E-980D-4B01-889F-447D66D0B58D@insensate.co.uk> <20110216174011.GZ96213@shinkuro.com> <20110218143653.GC84482@bikeshed.isc.org> <20110218151209.GF66684@shinkuro.com> <4D5EEE09.4080405@dougbarton.us> <20110218222950.GL74065@shinkuro.com> <4D5F270F.20401@abenaki.wabanaki.net> <199C7B2B4228461FB024E59A990DB46D@ics.forth.gr> <4D641DB6.4090705@necom830.hpcl.titech.ac.jp> <20110222205617.GS53815@shinkuro.com> <4D64489B.7020901@necom830.hpcl.titech.ac.jp> <713D992A-1DB9-4F72-9D18-8E923AD51D8D@icsi.berkeley.edu> <AANLkTikf2ixw7JkxQiRBobv-seYnaYS0E3G8TboosnA=@mail.gmail.com> <alpine.LSU.2.00.1102231029260.27602@hermes-1.csi.cam.ac.uk> <AANLkTin6-mXBeKC_TzgvWUaCyxKfeZxTK1BQvXtpwuCN@mail.gmail.com>
To: Phillip Hallam-Baker <hallam@gmail.com>
X-Mailer: Apple Mail (2.1082)
Cc: Nicholas Weaver <nweaver@ICSI.Berkeley.EDU>, dnsext@ietf.org
Subject: Re: [dnsext] we need help to make names the same, was draft-yao-dnsext-identical-resolution-02 comment
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 21:48:16 -0000

On Feb 23, 2011, at 12:00 PM, Phillip Hallam-Baker wrote:

> 
> 
> On Wed, Feb 23, 2011 at 5:30 AM, Tony Finch <dot@dotat.at> wrote:
> On Tue, 22 Feb 2011, Phillip Hallam-Baker wrote:
> 
> > If you are going to do [online signing], you might as well do a key
> > exchange inline as well as we do in TLS. One key exchange can then be
> > leveraged across multiple connections using kerberos style tickets (see
> > DPLS for an example).
> 
> That gives you channel security whereas DNSSEC gives you data origin
> authentication. They are not the same things.
> 
> True, but data origin authentication is probably the wrong model for a DNS security scheme.
> 
> If we are going to consider changing the model of DNSSEC, which is what moving to online signatures would entail, then the whole architecture is back on the table. 

Online signatures work within the existing DNSSEC model, you just need to be willing to pay the computational cost in the cases where it is necessary (eg, mixed-casing non-ascii)

v2.23.0 | Report a Bug | By Email