[Hipsec-rg] reverse DNS lookups of HITs

[thomas.r.henderson at boeing.com (Henderson, Thomas R)]

 

> >
> >> I think we (myself included) should all go read the FARA 
> paper again:
> >>
> >> FARA: Reorganizing the Addressing Architecture ( the first of 3  
> >> papers at http://www.isi.edu/newarch/fara.html )
> >
> > I guess it would take some time to deploy a solution which 
> requires  
> > new network architecture, when we need something to use now.
> 
> Those papers represent some serious research into the 
> implications of  
> the architecture.  We've implemented something with HIP, but 
> it seems  
> there is disagreement as to the architecture... if reverse 
> lookups are  
> even desirable is an architectural question, after all.  
> Personally, I  
> think there is no need for reverse lookups.
> 

I do not think there is disagreement with the architecture, but perhaps
the service model. I think there is no need for reverse lookups if
entities involved (including third party middleboxes) are handling HITs
directly, or if the HIT to domain name mapping is preconfigured, or if
the systems use other name resolution services than DNS.  However, I
suspect that will not always be the case.

Note that ssh implementations sometimes performs reverse lookups for
host authentication.  What do you see as being different for HIP?

- Tom