Re: [nbs] NBS and TCP connection identification

Hi Erik:

Thanks for reviewing both documents.  A few comments; Javier will fill in the rest.

- You are right that TCP connections will be identified by a pair of DNS names.  Implementation-wise, this could be realized by hashing the DNS names into 128-bit strings.  Then, a TCP-for-IPv6 implementation could pretty much be reused.

- Security-wise, the idea is to bind DNS names to IP addresses by means of a forward lookup in the DNS.  This gives the same level of security that we have for DNS-based applications today, except that the forward lookup would not just be done by the connection initiator, but also by the connection responder.  Where higher security is required, we recommend DNSSEC.  Thus we can avoid extra cryptographic identifiers.

- Hosts that don't have a name registered in the DNS will derive a DNS name from their IP address.  This will give them session continuity, albeit no reachability.

Does this make sense?

So long,
- Christian

You wrote:

> 
> I'm quite intriqued by name-based sockets, but I don't understand how things are supposed to work.
> I've read draft-ubillos-name-based-sockets-03.txt and draft-xu-name-shim6-00.txt, but some aspects appear to be missing.
> 
> Does with NBS what identifies a TCP connection? Today it is identified by a pair of IP addresses and port numbers, but that wouldn't work with NBS since we want the TCP connection to survive renumbering the IP addresses. Is the intent that the connection be identified by a pair of names? By fixed-length hashes of the names?
> 
> What are the security issues introduced by the additional name mapping? (Part of that answer depends on how TCP connections are identified.) It might be useful to review RFC 4218 and see what threats apply to NBS.
> 
> In name-shim6-00.txt there is a suggestion to communicate the names in NBS, and then in addition communicate the names (or MD5-hashes of the names) in shim6. That seems to be overkill.
> 
> 
> Instead of a nonce as a name I think it makes more sense to use a crypto-based identifier (see
> http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.139.4051&rep=rep1&type=pdf). Such a name/ID means that even a host which does not have a FQDN can benefit from multihoming and mobility using NBS without introducing any security issues.
> 
>   Erik
> 
> 
> _______________________________________________
> nbs mailing list
> nbs@ietf.org
> https://www.ietf.org/mailman/listinfo/nbs