Re: [v6ops] NAT64/DNS64 and DNSSEC

[Philip Homburg <[e-mail]>]

In your letter dated Wed, 29 Jul 2015 12:06:14 +0200 you wrote:
>That is why there is a requirement in RFC7050 Section 3.1. to validate
>network-specific NAT64 prefix using reverse and forward DNSSEC secured
>queries. The only problem is that there is no way so far how to seed the
>list of trusted NSP domains. Instead of asking users "Do you want to
>trust the network prefix dns64.example.org?", there could probably be
>some matching with domain name received by other means like DHCP or DNSSL=
>=2E
>
>Of course, using the Well-known prefix is on the safe side, and should
>be IMO used wherever applicable.

It seems to me that Section 3.1 is very far from something can be implemented
in a practical way in a consumer device.

I.e. if a user with a mobile device connects to a random network that employs
NAT64, there is essentially no way for an ordinary user to verify if the
prefix is valid or not.

Now if there would be DHCPv6 and RA options for the prefix, there would be
no need to discover the prefix using the DNS64 resolver and the problem would
reduce to whether to trust DHCPv6 or RA. Which is already part of the
security model (i.e. RA guard can protect users from each other).