Re: [dnsext] draft-diao-aip-dns

My own $.02 as well, on just one little piece...

> 5.  Security Considerations
> 
>    There is no additional security requirement than current domain name
>    system. Security issues are not discussed in this memo.

To put this succinctly, Hu?!?

The point of this is to allow a country to "override the root": provide its own DNS hierarchy which it controls to create an "Autonomous Internet", namely, a namespace which deliberately excludes "undesirable" names.  Because unless you are excluding "undesirable" names, what is the benefit of having two separate namespaces for the same name in different countries? [1]

This goes strictly contrary to DNSSEC, where, out of operational concerns, all validators know the same universal root signing key.  

Each "Autonomous Internet" would require its own root key, and any client which may move between multiple AIPs would need to either a-proiri know all distinct AIP root keys or somehow securely discover the individual AIP's root key (HOW?!)

There is also the namespace confusion problem, which is a security problem:  www.example.com in AIP A ?= www.example.com in AIP B.

This is a huge concern, even if you solve the DNSSEC key problem, since subverting either AIP will affect all clients in that AIP, and any client who goes between AIPs.

Fragmenting the namespace IS a security problem.

[1] And if you want to block undesirable names, the existing infrastructure does a good job of it.

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext