Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Tue, 25 Oct 2005 15:02:32 +0200

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] 
> Sent: Tuesday, October 25, 2005 2:10 PM
> To: COMBES Jean-Michel RD-MAPS-ISS
> Cc: Gerardo Giaretta; Kilian Weniger; Alexandru Petrescu; 
> [email-masked]
> Subject: Re: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt 
> 
>  In your previous mail you wrote:
> 
>    If you want to update the DNS servers frequently, DNSSEC cannot be
>    usable:
>    - for each update you will have to sign the zone
>    - for each update you will have to transfer the signed zone to the
>    secondary servers
>    ...
>    
> => this is not true: you can use dynamic updates and you can 
> put the critical RRs in a small zone in order to mitigate the 
> main issue of dynamic updates with DNSSEC 

Maybe, this is a solution but that will depend a lot on the number of HA
the MSP will manage and you will still have to transfer the signed zone
to the secondary servers.

> (the private key 
> must be online).

Which private key? The one used to sign the zone or to secure the
updates?
If this is the first one, the habit is to avoid to put it online (I know
you know that :)

> 
>    So forget DNSSEC in such a case: result, no more security.
>    
> => I disagree: the only real problem with DNSSEC is it is not 
> yet deployed.

This is for me another issue (BTW, today, IKEv2 is not deployed too and
most of the work in mip6 are on IKEv2).

> 
> Regards
> 
> [email-masked]
> 

Regards.

JMC.

France Telecom - R&D Division - MAPS/NSS   
Jean-Michel COMBES, Internet/Intranet Security
E-Mail: [email-masked]
Phone: +33 (0)1 45 29 45 94
Fax: +33 (0)1 45 29 65 19
Mobile: +33 (0)6 07 29 30 16 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 25 Oct 2005 17:58:39 +0200

the MSP will manage

=> I can't see why... dynamic update is a valid way to manage leaf zones.

   and you will still have to transfer the signed zone to the
   secondary servers.
   
=> the propagation of updates is a part of the dynamic update mechanism
(i.e., you have not to worry about).
   
   > must be online).
   
   Which private key?

=> the private part of the zone signing key pair.

   The one used to sign the zone or to secure the updates?

=> the first one.

=> this is why DNSSEC and dynamic updates are not "friendly".

   
=> this is because IKEv1 is so limited (cf my comments about the
bootstrapping with IKEv1 I-D). And DNSSEC is an infrastructure, something
which is always hard to deploy.

Regards