Subject: Re: ignoring icmp to make dtls work for the stub/RDNS relationship
From: "Roy Arends" <[email-masked]>
To: Paul Vixie <[email-masked]>
Cc: [email-masked]
Date: Tue, 22 Jul 2008 10:55:21 +0200
List-Id: <namedroppers.ops.ietf.org>

Paul Vixie wrote on 07/22/2008 10:33:42 AM:

> ignoring icmp to make dtls work for the stub/RDNS relationship
> 
> i really like the simplicity of the "just use dtls" approach.  it can be
> done without a X.509 certification hierarchy, just ephemeral self-signed
> certs.  it can be done without secrecy-encryption, using the null 
cipher.
> there are libraries that implement it on several popular platforms. 
there
> is an internet draft.  it avoids all questions involving DNS payload or
> format changes.  it would be way easier to implement than TKEY+TSIG, not
> in processor cycles mind you, but in number of lines of code a DNS guy
> would have to write.

I really like the simplicity of "just running your own validating caching 
dns resolver" approach, like DRC suggested very early in a previous 
thread. 

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>