IETF Logo Mail Archive

Re: [dnsext] we need help to make names the same, was draft-yao-dnsext-identical-resolution-02 comment

Phillip Hallam-Baker <hallam@gmail.com> Thu, 24 February 2011 12:44 UTC

Return-Path: <dnsext-bounces@ietf.org>
X-Original-To: namedroppers-archive-gleetwall6@lists.ietf.org
Delivered-To: ietfarch-namedroppers-archive-gleetwall6@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE52F3A68A7; Thu, 24 Feb 2011 04:44:10 -0800 (PST)
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 77A5E3A6AB6 for <dnsext@core3.amsl.com>; Thu, 24 Feb 2011 04:44:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.563
X-Spam-Level:
X-Spam-Status: No, score=-3.563 tagged_above=-999 required=5 tests=[AWL=0.035, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t8llXi1u6pFi for <dnsext@core3.amsl.com>; Thu, 24 Feb 2011 04:44:07 -0800 (PST)
Received: from mail-bw0-f44.google.com (mail-bw0-f44.google.com [209.85.214.44]) by core3.amsl.com (Postfix) with ESMTP id 63AE53A6878 for <dnsext@ietf.org>; Thu, 24 Feb 2011 04:44:07 -0800 (PST)
Received: by bwz13 with SMTP id 13so1185008bwz.31 for <dnsext@ietf.org>; Thu, 24 Feb 2011 04:44:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=bt3+rCyjI3VuLAokTSnlfDLDx9OuTppQnVBe4iOQYPk=; b=mIbnxPqLEpaErImKBd7wnSBszFDCE2sjBDJE9s9OuF+I+FsprTg+iLKvCw6cC6PZtB cK31COqj0WvLIYK9iKs0SyuxpD1gkyJlztQhpMWyReaaamMUETXQ3an1EWzjNMSn2Q2E TVV+Ht7cgWvg8djALOtdJ9PPecqVGAOpSeT04=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=BacCFLSPWeQUlcKNv7KrjP6oRLjbaGFe455xirlfyB3mhvA6GPABoxfyBrkyhh9weH pOJhVHv3NQNvzoWjbAE1w3Od8Ds6KXqIb8I9g7WH/bjqdiR1K//od0dRuaSJRPA//o7V SEdWwUy1NTYchyNhQLQ4vD/1hZqCbSmgnfTjk=
MIME-Version: 1.0
Received: by 10.204.7.213 with SMTP id e21mr705198bke.47.1298551495267; Thu, 24 Feb 2011 04:44:55 -0800 (PST)
Received: by 10.204.14.139 with HTTP; Thu, 24 Feb 2011 04:44:55 -0800 (PST)
In-Reply-To: <alpine.LSU.2.00.1102240953550.5244@hermes-1.csi.cam.ac.uk>
References: <20110216165921.GW96213@shinkuro.com> <3B90ED2E-980D-4B01-889F-447D66D0B58D@insensate.co.uk> <20110216174011.GZ96213@shinkuro.com> <20110218143653.GC84482@bikeshed.isc.org> <20110218151209.GF66684@shinkuro.com> <4D5EEE09.4080405@dougbarton.us> <20110218222950.GL74065@shinkuro.com> <4D5F270F.20401@abenaki.wabanaki.net> <199C7B2B4228461FB024E59A990DB46D@ics.forth.gr> <4D641DB6.4090705@necom830.hpcl.titech.ac.jp> <20110222205617.GS53815@shinkuro.com> <4D64489B.7020901@necom830.hpcl.titech.ac.jp> <713D992A-1DB9-4F72-9D18-8E923AD51D8D@icsi.berkeley.edu> <AANLkTikf2ixw7JkxQiRBobv-seYnaYS0E3G8TboosnA=@mail.gmail.com> <alpine.LSU.2.00.1102231029260.27602@hermes-1.csi.cam.ac.uk> <AANLkTin6-mXBeKC_TzgvWUaCyxKfeZxTK1BQvXtpwuCN@mail.gmail.com> <4CC95816-8225-4CAE-897F-3F13F965BCEE@ICSI.Berkeley.EDU> <alpine.LSU.2.00.1102240953550.5244@hermes-1.csi.cam.ac.uk>
Date: Thu, 24 Feb 2011 07:44:55 -0500
Message-ID: <AANLkTiniVDDZXFOV4WryNN=+hK29rBO8_HTAqw7bK=Nf@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: Tony Finch <dot@dotat.at>
Cc: dnsext@ietf.org
Subject: Re: [dnsext] we need help to make names the same, was draft-yao-dnsext-identical-resolution-02 comment
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============1915671743=="
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

On Thu, Feb 24, 2011 at 5:07 AM, Tony Finch <dot@dotat.at> wrote:

> On Wed, 23 Feb 2011, Nicholas Weaver wrote:
> > On Feb 23, 2011, at 12:00 PM, Phillip Hallam-Baker wrote:
> > >
> > > True, but data origin authentication is probably the wrong model for a
> > > DNS security scheme.
>
> If you want to argue that, please get in your time machine and go back to
> 1993.
>

Why would I need a time machine? You still don't have anyone actually using
DNSSEC for production?

That snark might be justified if this was a system that was being deployed
and used, but the original premise of the question was that it was necessary
to revisit the design of DNSSEC in major ways to solve the 'same resolution'
problem.



> > If we are going to consider changing the model of DNSSEC, which is
> > > what moving to online signatures would entail, then the whole
> > > architecture is back on the table.
> >
> > Online signatures work within the existing DNSSEC model, you just need
> > to be willing to pay the computational cost in the cases where it is
> > necessary (eg, mixed-casing non-ascii)
>
> You can predict in advance the maximum size of the signature cache you
> will need (since it's the same size as a pre-signed zone) and once the
> cache is populated the work you need to do is exactly the same as for
> re-signing a static zone. There are some cases where the maximum cache is
> unfeasibly huge, for example pool.ntp.org, in which case you might be able
> to get away with a smaller cache (which implies more computational work)
> or a more restricted data model.
>

That would be a totally bizarre response to a requirement that is nonsense.

If we had a time machine and could go back to 1983, making the DNS support
this particular requirement might make sense.

But unlike DNSSEC, the DNS is deployed and used.

-- 
Website: http://hallambaker.com/

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

v2.23.0 | Report a Bug | By Email