Re: [v6ops] NAT64/DNS64 and DNSSEC

Brian E Carpenter <brian.e.carpenter@gmail.com> Thu, 23 July 2015 07:42 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 307661A87F1 for <v6ops@ietfa.amsl.com>; Thu, 23 Jul 2015 00:42:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6u_8X-_8M3QN for <v6ops@ietfa.amsl.com>; Thu, 23 Jul 2015 00:42:49 -0700 (PDT)
Received: from mail-wi0-x229.google.com (mail-wi0-x229.google.com [IPv6:2a00:1450:400c:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB2F61A8706 for <v6ops@ietf.org>; Thu, 23 Jul 2015 00:42:48 -0700 (PDT)
Received: by wibxm9 with SMTP id xm9so135722446wib.1 for <v6ops@ietf.org>; Thu, 23 Jul 2015 00:42:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:organization:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=hniAsQPx2/Jn5HF0wzRlua5cOmqQBjiG/l+baIov3YM=; b=wg3gy41rOrgrBpndb2ybP7gR+bL7Gge1VZimOqTaIreBEXMc1yKCij2ccAfc/5n4Tc Fy9VtqjBisGR/ND1AyphwJfi/C5LWnxZkzYXg6rK45LIE603lshsykoS29ClDzkVJjo+ 4MsdSE1Ocu7LsEC9N+djqfWYwqu+hdoxjOIb/IuJyyBe0pUY6DRvaS7FTeSrRauW9LQB ziyiRiYvGJ9p3rRr57xgC8o5ChapGL1zYhcIvfKCSLS51dzzCjQDEsnl263/nvricoRM cI0ed/xejDJ6WPXuApZJqHB8vNmiudT3rpqUMua/fANecqxZ27kghNse6IkcObCtil6L YFog==
X-Received: by 10.194.85.130 with SMTP id h2mr14003494wjz.2.1437637367541; Thu, 23 Jul 2015 00:42:47 -0700 (PDT)
Received: from [31.133.177.248] (dhcp-b1f8.meeting.ietf.org. [31.133.177.248]) by smtp.gmail.com with ESMTPSA id x10sm6108207wjr.25.2015.07.23.00.42.46 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Jul 2015 00:42:46 -0700 (PDT)
Message-ID: <55B09AE5.4040609@gmail.com>
Date: Thu, 23 Jul 2015 19:42:29 +1200
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: Mikael Abrahamsson <swmike@swm.pp.se>, v6ops@ietf.org
References: <alpine.DEB.2.02.1507230910190.11810@uplift.swm.pp.se>
In-Reply-To: <alpine.DEB.2.02.1507230910190.11810@uplift.swm.pp.se>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/v6ops/UkLu3SwdEw_NIk4IHz_IeuRzXOs>
Subject: Re: [v6ops] NAT64/DNS64 and DNSSEC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Jul 2015 07:42:50 -0000

Read RFC 6147 - it covers this issue, and points out that
"The main drawback of this mode is its
deployability, since it requires changes in the end hosts."

Regards
   Brian

On 23/07/2015 19:13, Mikael Abrahamsson wrote:
> 
> Hi,
> 
> as far as I know, DNS64 and DNSSEC are fundamentally incompatible, because modifying A records into AAAA records breaks DNSSEC.
> 
> Since we now have implementations (from what I understand at least APple does this) that do bump-in-the-API, would it make sense
> to work on a document that recommends to just use DNS64 just to discover the NAT64 prefix, and then do bump-in-the-API synthesis
> to do the A-to-AAAA NAT64-mapping?
> 
> I really care about DNSSEC and I don't want this to be broken for a prolonged amount of time just because people are doing
> NAT64+DNS64.
>