Re: [Hipsec] HIT to IP in DNS

A few comments below.

> -----Original Message-----
> From: Oleg Ponomarev [mailto:oleg.ponomarev@hiit.fi] 
> Sent: Monday, January 19, 2009 3:14 PM
> To: hipsec@ietf.org
> Subject: [Hipsec] HIT to IP in DNS
> 
> Hi!
> 
> I just submitted an initial version of a draft[1] to specify 
> one of the 
> methods used in HIPL[2] to do the HIT->current IP addresses 
> resolution. 
> This is needed to run legacy applications.

I disagree that this is strictly needed to run legacy applications.
Perhaps "may be useful" instead of "needed"?

> 
> Briefly: query A/AAAA 
> 8.7.6.5.4.3.2.1.0.f.e.d.c.b.a.9.8.7.6.5.4.3.2.1.0.1. 
> 0.0.1.0.0.2.hit-to-ip.example.net. and allow their changes from the 
> corresponding HIT.
> 
> Your comments are appreciated as usual.

You are really talking about defining domain names based on HITs and
storing them in a well known domain.  Maybe the title could be
simplified to "Storing HITs as domain names in the DNS".

What if the target end system uses an RVS?  

   2.1. Preconfigured Domain
   The systems using this method MUST have the same domain pre-
   configured, for example hit-to-ip.example.net.  

It seems like this could be slightly relaxed to state that systems MUST
share at least one top-level domain storing the HITs, since it is
conceivable that more than one server (name service provider) could be
used, and records could be looked up at multiple places.

   2.4  Managing the Records
   The system MAY send DNS UPDATE[RFC2136] to the server provided by SOA
   MNAME field of the domain.  The system MUST use HIT as the source
   address in this case.  

Can you clarify what "source address" you are talking about above?

   The system MAY add or delete A/AAAA or CNAME
   records for its own HIT representation.  The domain provided in SOA
   MNAME field of the preconfigured domain MUST have Host Identity of
   the server stored in DNS, the IP addresses MUST be listed in that
   domain using suggested method and the server MUST accept DNS UPDATE
   messages, which add or delete A/AAAA or CNAME records for the HIT
   representation of the client after successfull HIP base exchange.

It might be helpful to clarify that the HIP base exchange here serves to
authenticate the origin of the DNS UPDATE, from the server's
perspective.

Also, DHTs are an alternative lookup mechanism that can be used in this
scenario; it would be helpful to reference that draft:
http://tools.ietf.org/html/draft-ahrenholz-hiprg-dht-03

- Tom
_______________________________________________
Hipsec mailing list
Hipsec@ietf.org
https://www.ietf.org/mailman/listinfo/hipsec