Re: [Hipsec] HIT to IP in DNS

[Oleg Ponomarev <[e-mail]>]

Hi! On Wed, 21 Jan 2009, Henderson, Thomas R wrote:

Apologies for the late reply, I did not have time to update the draft 
before, but now submitted its new version that is available at 
http://www.ietf.org/internet-drafts/draft-ponomarev-hip-hit2ip-02.txt

This version has much longer discussion about the usage and deployment.


> You are really talking about defining domain names based on HITs and
> storing them in a well known domain.  Maybe the title could be
> simplified to "Storing HITs as domain names in the DNS".

Right, I changed it to "Embedding Host Identity Tags Data in DNS"


> What if the target end system uses an RVS?

This is just an interface to HIT->IP database, a rendezvous server may 
update the mapping with its own interface, but it is not covered in the 
draft.


>   2.1. Preconfigured Domain
>   The systems using this method MUST have the same domain pre-
>   configured, for example hit-to-ip.example.net.
>
> It seems like this could be slightly relaxed to state that systems MUST
> share at least one top-level domain storing the HITs, since it is
> conceivable that more than one server (name service provider) could be
> used, and records could be looked up at multiple places.

Ok, I added a usage scenario with multiple independent mapping services.


>   2.4  Managing the Records
>   The system MAY send DNS UPDATE[RFC2136] to the server provided by SOA
>   MNAME field of the domain.  The system MUST use HIT as the source
>   address in this case.
>
> Can you clarify what "source address" you are talking about above?

Sure, I changed to "The system MAY add or delete A,AAAA,PTR,CNAME records 
for its own HIT representation.The update MUST then originate from the 
corresponding HIT".


>   The system MAY add or delete A/AAAA or CNAME
>   records for its own HIT representation.  The domain provided in SOA
>   MNAME field of the preconfigured domain MUST have Host Identity of
>   the server stored in DNS, the IP addresses MUST be listed in that
>   domain using suggested method and the server MUST accept DNS UPDATE
>   messages, which add or delete A/AAAA or CNAME records for the HIT
>   representation of the client after successfull HIP base exchange.
>
> It might be helpful to clarify that the HIP base exchange here serves to
> authenticate the origin of the DNS UPDATE, from the server's
> perspective.

Added.

> Also, DHTs are an alternative lookup mechanism that can be used in this
> scenario; it would be helpful to reference that draft:
> http://tools.ietf.org/html/draft-ahrenholz-hiprg-dht-03

Thanks for you feedback and for this tip, I wanted to mention DHT, but 
could not find this ID in the archive of hip-related drafts. Would it make 
sense to show "*-hiprg-*" on the HIP WG page as well? AFAIK extended 
mapping of Internet Drafts (by name) to WG was implemented recently.

-- 
Regards, Oleg.