IETF Logo Mail Archive

Re: DNSCurve vs. DNSSEC - FIGHT! (was OpenDNS today announced it has adopted DNSCurve to secure DNS)

Paul Wouters <paul@xelerance.com> Wed, 24 February 2010 20:55 UTC

Return-Path: <paul@xelerance.com>
X-Original-To: ietf@core3.amsl.com
Delivered-To: ietf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C8D3B28C112 for <ietf@core3.amsl.com>; Wed, 24 Feb 2010 12:55:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.553
X-Spam-Level:
X-Spam-Status: No, score=-2.553 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K+6LOsf5T+VG for <ietf@core3.amsl.com>; Wed, 24 Feb 2010 12:55:16 -0800 (PST)
Received: from newtla.xelerance.com (newtla.xelerance.com [193.110.157.143]) by core3.amsl.com (Postfix) with ESMTP id F3F673A8594 for <ietf@ietf.org>; Wed, 24 Feb 2010 12:55:15 -0800 (PST)
Received: from tla.xelerance.com (tla.xelerance.com [193.110.157.130]) by newtla.xelerance.com (Postfix) with ESMTP id 19071BC07; Wed, 24 Feb 2010 15:57:23 -0500 (EST)
Date: Wed, 24 Feb 2010 15:57:23 -0500
From: Paul Wouters <paul@xelerance.com>
To: Tony Finch <dot@dotat.at>
Subject: Re: DNSCurve vs. DNSSEC - FIGHT! (was OpenDNS today announced it has adopted DNSCurve to secure DNS)
In-Reply-To: <alpine.LSU.2.00.1002242049510.16971@hermes-2.csi.cam.ac.uk>
Message-ID: <alpine.LFD.1.10.1002241554540.18920@newtla.xelerance.com>
References: <874c02a21002231826y613b9f97ya83740ba240f7bf9@mail.gmail.com> <ABE739C5ADAC9A41ACCC72DF366B719D02C29D87@GLKMS2100.GREENLNK.NET> <a123a5d61002240700i4a68367tf901b91265f79da1@mail.gmail.com> <1267039830.9710.11106.camel@shane-asus-laptop> <alpine.LSU.2.00.1002242049510.16971@hermes-2.csi.cam.ac.uk>
User-Agent: Alpine 1.10 (LFD 962 2008-03-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Cc: IETF Discussion <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Feb 2010 20:55:16 -0000

On Wed, 24 Feb 2010, Tony Finch wrote:

> On Wed, 24 Feb 2010, Shane Kerr wrote:
>>
>> DNSSEC declares out of scope:
>>       * the channel where DS records get added to the parent
>
> Is that actually out of scope or just not specified yet?

Out of scope. It is the bootstrap problem. Though with RFC-5011
and perhaps draft-wijngaards-dnsop-trust-history-02 the above
bullet might should probably read "were initial DS records get added"

Once you have established the first DS record, you should be able
to rollover without losing the path of trust.

Paul

v2.23.0 | Report a Bug | By Email