[Hipsec-rg] reverse DNS lookups of HITs

[oleg.ponomarev at hiit.fi (Oleg Ponomarev)]

On Tue, 13 Jan 2009, Andrew McGregor wrote:

> your HIP implementation knows about FQDNs sent by the other end

Oh, I thought you do not like reverse DNS for HITs in general. Yes, I 
mentioned it as another solution (https://listserv.cybertrust.com/ 
pipermail/hipsec-rg/2009-January/000567.html)

But how much effort will it take to modify all resolver libraries? It 
would be much more difficult to debug. Deployment?


>> I would like to grant access to the clients from example-company.com 
>> regardless of their current locators. If there is no forward confirmed 
>> reverse DNS, what should I do now?
>
> Certificates for this one.

Ok, how should I configure my nntp-server (whatever legacy service) to 
demand certificates from the clients? How much tech support resources I 
will spend to change settings of their nntp-readers (whatever legacy 
clients). Will they keep using my service?

I do not need high-grade security in this case and do not want to waste 
resources.

-- 
Regards, Oleg.