Re: [P2PSIP] Auth/boot is weakest link

["Peter Pan" <[e-mail]>]

do u mean that we should turn our heads away from dht technologies?

another question, can existing dns infrastructure carry millions or even
billions of individual sip ua's without overhaul?

thank u.

pp

----- Original Message -----
From: "David Barrett" <[e-mail]>
To: "'Hannes Tschofenig'" <[e-mail]>
Cc: <[e-mail]>
Sent: Monday, August 20, 2007 12:57 PM
Subject: RE: [P2PSIP] Auth/boot is weakest link


> Well, DNS and mDNS are proven solutions to the problem of resolving names
to
> IP addresses, and thus were tossed out as candidate solutions for
resolving
> SIP names to UA IP addresses.  In summary it'd work like this:
>
> 1) Users purchase DNS names from any registrar supporting dynamic DNS
> 2) When you install a SIP UA, you plug in your domain name
> 3) When your UA starts up, it updates your DNS name to resolve to your IP
> 4) Furthermore, it listens on the mDNS port for attempts to resolve your
DNS
> 5) When you call me, your UA just resolves my DNS name to get my IP
> 6) If that fails, it also tries an mDNS broadcast to see if we're on a LAN
>
> The result is you get authentication (performed by the DNS registrar) and
> rendezvous (performed by DNS/mDNS) without depending upon any single
> provider: rather than Skype, Inc. being wholly responsible for (and having
> complete control over) all P2P calls, every user has the legal and
technical
> right to switch entirely to a different provider.  It's still
"centralized"
> in the sense that it depends upon centrally hosted servers, but it's
> "distributed" between many technical and legal entities.
>
> To give an example:
> 1) I purchase "quinthar.com" from any dynamic-DNS registrar [1]
> 2) I install my SIP UA and tell it my name is "dbarrett.quinthar.com"
> 3) On startup, it figures out my latest IP address, and uses dynamic DNS
to
> update the record for "dbarrett.quinthar.com" to resolve to my laptop.
> 4) Likewise, it listens on the mDNS port to see if anybody tries to
resolve
> "dbarrett.quinthar.com"
> 5) When you call me, your UA does a totally-standard DNS resolve on
> "dbarrett.quinthar.com" and comes up with my laptop's IP address
> 6) Alternatively, if we're on an ad-hoc network in the middle of a desert
> and for some reason yelling is insufficient, you broadcast an mDNS request
> on the WLAN for "dbarrett.quinthar.com" and my UA responds with my WLAN IP
> address.
>
> At any point, you or I can change our DNS registrars and the system
> continues to function as normal.  Indeed, even if the provider of our SIP
> software (eg, Skype) goes out of business or is taken over by a malevolent
> force, it has absolutely no knowledge of or control over our calls.
>
> [1]
>
http://www.dmoz.org/Computers/Software/Internet/Servers/Address_Management/D
> ynamic_DNS_Services/
>
>
> We had a *long* discussion on this last year, with Adam Fisk first
> suggesting the use of dynamic DNS:
>
> http://www1.ietf.org/mail-archive/web/p2psip/current/msg01632.html
>
> And then Matthew Kaufman suggesting adding mDNS to the mix:
>
> http://www1.ietf.org/mail-archive/web/p2psip/current/msg01688.html
>
> I summarized how the combination of the two (I didn't know about mDNS at
the
> time, so I was theorizing some "P2P-DNS") effectively cover all the P2PSIP
> use cases, without all the hassle of a DHT:
>
> http://www1.ietf.org/mail-archive/web/p2psip/current/msg01679.html
>
>
> Now, that's all background.  As for how this would help Skype, that's not
> entirely clear given it's not clear what precise problem Skype suffered.
> Indeed, their explanation that it was due to a massive restart surge
> triggered by Windows Update seems really unlikely to me.
>
> But, assuming that's true, the system above would fare much better because
> it is geographically distributed over many more servers, managed by a
> variety of entirely distinct legal entities, and constructed from a wide
> diversity of hardware and software.  It uses standard, open protocols, all

> of which already exist today and have been proven at scale.  It works as
> well from your office as it does in a post-Katrina disaster zone.
>
> Anyway, now you've got me riled up talking about it, but it probably isn't
> useful to revisit and rehash the former inconclusive debate.
>
> Regardless, the reason I brought it up is I'm curious what other options
are
> on the table for bootstrapping/authentication/rendezvous.  I've mentioned
> dynamic-DNS/mDNS and provided some summary around that.  Can you provide
> some summary around alternative solutions?
>
> Brian Rosen put forward some general guidelines and requirements around a
> solution (which, incidentally, I think the above dynDNS/mDNS solution
> meets).  Brian -- Can you give any more detail on this?
>
> -david
>
> PS: I haven't read the drafts you mentioned; I'll take a look but they
look
> good at first glance!
>
> > -----Original Message-----
> > From: Hannes Tschofenig [mailto:[e-mail]]
> > Sent: Monday, August 20, 2007 2:38 AM
> > To: David Barrett
> > Cc: [e-mail]
> > Subject: Re: [P2PSIP] Auth/boot is weakest link
> >
> > Hi David,
> >
> > could you explain a bit more why you think that mDNS would help to solve
> > the problems Skype faced?
> >
> > When you talk about mDNS then do you have these solutions in mind?
> > http://tools.ietf.org/id/draft-lee-sip-dns-sd-uri-01.txt
> > http://www.xmpp.org/extensions/xep-0174.html
> >
> > Ciao
> > Hannes
> >
> > David Barrett wrote:
> > > Any thoughts on the latest Skype debacle?
> > >
> > > Generally Skype is held up as justification of the power of p2p voip.
> > > However, as clearly evidenced in the past week, a system is only as
> > > decentralized as its most centralized link: in this case,
> > > bootstrapping and authentication.
> > >
> > > What's the latest thinking about how p2psip would fare better?
> > >
> > > While no official position has been taken on the issue, it's been
> > > argued that a combination of DNS/mDNS makes a good candidate.  (Though
> > > technically centralized, it's highly redundant and distributed, as
> > > well as decentralized in a legal sense -- especialy when compared to
> > > Skype!)
> > >
> > > What other options are on the table for providing authentication and
> > > bootstrapping in a way that's superior to Skype?
> > >
> > > -david
> > >
> > > _______________________________________________
> > > P2PSIP mailing list
> > > [e-mail]
> > > https://www1.ietf.org/mailman/listinfo/p2psip
>
>
> _______________________________________________
> P2PSIP mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/p2psip


_______________________________________________
P2PSIP mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/p2psip