Return-Path: X-Original-To: ietfarch-namedroppers-archive-gleetwall6@core3.amsl.com Delivered-To: ietfarch-namedroppers-archive-gleetwall6@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 593493A68B2; Tue, 22 Jul 2008 02:00:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.924 X-Spam-Level: X-Spam-Status: No, score=-2.924 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, J_CHICKENPOX_44=0.6, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t4tGAQFGj32d; Tue, 22 Jul 2008 01:59:59 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B7CD33A67F4; Tue, 22 Jul 2008 01:59:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1KLDed-0008bF-Ay for namedroppers-data@psg.com; Tue, 22 Jul 2008 08:55:31 +0000 Received: from [213.248.199.23] (helo=mx3.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1KLDeW-0008aa-H1 for namedroppers@ops.ietf.org; Tue, 22 Jul 2008 08:55:29 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=tK1gYDTRJxdd/kvVtehQ+d5hkl87mm8sO35h1y8cea86iP7H6iMhY42S TlO7EZVQE/TDt2Y5xbjtMs9XHclMVcbBBKRlROOludRKm9k6x0im5xAOU Qz/p4gapgZn3ANc; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=roy@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1216716924; x=1248252924; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20"Roy=20Arends"=20|Subject: =20Re:=20ignoring=20icmp=20to=20make=20dtls=20work=20for =20the=20stub/RDNS=20relationship|Date:=20Tue,=2022=20Jul =202008=2010:55:21=20+0200|Message-ID:=20|To:=20Paul=20Vixie=20|Cc:=20namedroppers@ ops.ietf.org|MIME-Version:=201.0|In-Reply-To:=20<78908.12 16715622@nsa.vix.com>|References:=20<78908.1216715622@nsa .vix.com>; bh=TMec/7PnmZW4eY6wgNkxdLNyABo+WHdhv+tgtBrOnQA=; b=lv/WRSCz+ukcbgp92CtxAaDZdH7njEfVSoxU1u5q8saJ+DowM2KXzrOX 0IuBvrCllz7dBhYg5C4OBzq92/FJVAUhXGzoMkNnYlL5qr/0N4OHPr270 J72xT+FQ3LE2QFz; X-IronPort-AV: E=Sophos;i="4.31,230,1215385200"; d="scan'208";a="5329555" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx3.nominet.org.uk with ESMTP; 22 Jul 2008 09:55:22 +0100 In-Reply-To: <78908.1216715622@nsa.vix.com> References: <78908.1216715622@nsa.vix.com> To: Paul Vixie Cc: namedroppers@ops.ietf.org Subject: Re: ignoring icmp to make dtls work for the stub/RDNS relationship MIME-Version: 1.0 X-Mailer: Lotus Notes Build VMac_Beta85_20080115_MM2 January 15, 2008 Message-ID: From: "Roy Arends" Date: Tue, 22 Jul 2008 10:55:21 +0200 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 22/07/2008 09:55:22 AM, Serialize complete at 22/07/2008 09:55:22 AM Content-Type: text/plain; charset="US-ASCII" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: Paul Vixie wrote on 07/22/2008 10:33:42 AM: > ignoring icmp to make dtls work for the stub/RDNS relationship > > i really like the simplicity of the "just use dtls" approach. it can be > done without a X.509 certification hierarchy, just ephemeral self-signed > certs. it can be done without secrecy-encryption, using the null cipher. > there are libraries that implement it on several popular platforms. there > is an internet draft. it avoids all questions involving DNS payload or > format changes. it would be way easier to implement than TKEY+TSIG, not > in processor cycles mind you, but in number of lines of code a DNS guy > would have to write. I really like the simplicity of "just running your own validating caching dns resolver" approach, like DRC suggested very early in a previous thread. Roy -- to unsubscribe send a message to namedroppers-request@ops.ietf.org with the word 'unsubscribe' in a single line as the message text body. archive: